8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-8wj8-cfxr-9374

GHSA-8wj8-cfxr-9374: AWS Advanced NodeJS Wrapper: Privilege Escalation in Aurora PostgreSQL instance

Description of Vulnerability:

An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.

AWS recommends that customers upgrade to the following version: AWS NodeJS Wrapper to v2.0.1.

Source of Vulnerability Report:

Allistair Ishmael Hakim allistair.hakim@gmail.com

Affected products & versions:

AWS NodeJS Wrapper < 2.0.1.

Platforms:

MacOS/Windows/Linux

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-8wj8-cfxr-9374

GHSA-8wj8-cfxr-9374:

8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
aws-advanced-nodejs-wrapper	npm	< 2.0.1	2.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a privilege escalation in the AWS Advanced NodeJS Wrapper for Aurora PostgreSQL, identified as GHSA-8wj8-cfxr-9374. It arises from the use of unqualified function and table names in internal SQL queries sent to the PostgreSQL database. A low-privilege authenticated database user could create crafted functions or tables (e.g., aurora_replica_status, pg_proc, VERSION) in a schema that is in their search path (like public).

When the node.js wrapper executes its internal queries for tasks like topology discovery, health checks, or dialect detection, the PostgreSQL server might resolve these function names to the user's malicious implementations instead of the intended system functions (which are typically in the pg_catalog schema). This allows the attacker's code to be executed with the privileges of the application's database connection, which could be a highly privileged role like rds_superuser, leading to a full database compromise.

The patch rectifies this by applying schema qualification (pg_catalog.) to all internal function and table references in the SQL queries. This ensures that the correct, trusted system objects are always invoked, mitigating the search path vulnerability.

The identified vulnerable functions are those within the various database dialect classes (PgDatabaseDialect, AuroraPgDatabaseDialect, etc.) that are responsible for constructing these unsafe SQL queries. These functions are called internally by the wrapper during its operation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-8wj8-cfxr-9374: AWS Advanced NodeJS Wrapper: Privilege Escalation in Aurora PostgreSQL instance

Description of Vulnerability:

Source of Vulnerability Report:

Affected products & versions:

Platforms:

GHSA-8wj8-cfxr-9374:

8

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

8

8

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Technical Details

GHSA-8wj8-cfxr-9374: AWS Advanced NodeJS Wrapper: Privilege Escalation in Aurora PostgreSQL instance

Description of Vulnerability:

Source of Vulnerability Report:

Affected products & versions:

Platforms:

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI