ReactPress has SQL injection via dynamic column names in TypeORM query builders

ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.

ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.

ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.

## Summary ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter *names* as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. ## Impact An unauthenticated remote attacker can perform blind SQL injection against the application database, potentially exfiltrating sensitive data (users, settings, API keys, article content, etc.). ## Affected endpoints (unauthenticated GET) - `GET /api/article` - `GET /api/comment` - `GET /api/file` - `GET /api/page` - `GET /api/Knowledge` ## Affected code Vulnerable pattern in `findAll()` methods, including but not limited to: - `server/src/modules/article/article.service.ts` - `server/src/modules/comment/comment.service.ts` - `server/src/modules/file/file.service.ts` - `server/src/modules/page/page.service.ts` - `server/src/modules/knowledge/knowledge.service.ts` ## Remediation - Whitelist allowed filter column names before interpolating into SQL. - Upgrade to `@fecommunity/reactpress` >= 3.7.0. ## Credit Reported by lsr365400.