-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| aws-advanced-nodejs-wrapper | npm | < 2.0.1 | 2.0.1 |
Miggo AIRoot Cause AnalysisThe vulnerability is a privilege escalation in the AWS Advanced NodeJS Wrapper for Aurora PostgreSQL, identified as GHSA-8wj8-cfxr-9374. It arises from the use of unqualified function and table names in internal SQL queries sent to the PostgreSQL database. A low-privilege authenticated database user could create crafted functions or tables (e.g., aurora_replica_status, pg_proc, VERSION) in a schema that is in their search path (like public).
When the node.js wrapper executes its internal queries for tasks like topology discovery, health checks, or dialect detection, the PostgreSQL server might resolve these function names to the user's malicious implementations instead of the intended system functions (which are typically in the pg_catalog schema). This allows the attacker's code to be executed with the privileges of the application's database connection, which could be a highly privileged role like rds_superuser, leading to a full database compromise.
The patch rectifies this by applying schema qualification (pg_catalog.) to all internal function and table references in the SQL queries. This ensures that the correct, trusted system objects are always invoked, mitigating the search path vulnerability.
The identified vulnerable functions are those within the various database dialect classes (PgDatabaseDialect, AuroraPgDatabaseDialect, etc.) that are responsible for constructing these unsafe SQL queries. These functions are called internally by the wrapper during its operation.
PgDatabaseDialect.getHostAliasQuerypg/lib/dialect/pg_database_dialect.ts
PgDatabaseDialect.getServerVersionQuerypg/lib/dialect/pg_database_dialect.ts
PgDatabaseDialect.isDialectpg/lib/dialect/pg_database_dialect.ts
AuroraPgDatabaseDialect internal query methodspg/lib/dialect/aurora_pg_database_dialect.ts
RdsMultiAZClusterPgDatabaseDialect.isReaderpg/lib/dialect/rds_multi_az_pg_database_dialect.ts
Ongoing coverage of React2Shell