CVE-2022-0944: Sqlpad Template Injection RCE Vulnerability

CVE-2022-0944 Overview

CVE-2022-0944 is a template injection vulnerability in the connection test endpoint of SQLPad, a web-based SQL editor. This flaw allows attackers with authenticated access to achieve Remote Code Execution (RCE) on the underlying server. The vulnerability affects all versions of SQLPad prior to 6.10.1 and stems from improper handling of template strings in connection configurations.

Critical Impact

Authenticated attackers can exploit template injection in the connection test endpoint to execute arbitrary code on the server, potentially leading to complete system compromise.

Affected Products

• SQLPad versions prior to 6.10.1
• SQLPad web-based SQL editor installations

Discovery Timeline

• 2022-03-15 - CVE CVE-2022-0944 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-0944

Vulnerability Analysis

This vulnerability is classified under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine) and CWE-94 (Improper Control of Generation of Code). The flaw exists in the connection rendering functionality of SQLPad, where user-controlled input is processed through an unsafe template engine without proper sanitization.

The vulnerable code utilized Lodash's template functionality to process connection configuration strings. Lodash templates, when not properly constrained, allow arbitrary JavaScript code execution through template expressions. An attacker with valid credentials could craft malicious template syntax within connection parameters that would be evaluated server-side during connection testing operations.

Root Cause

The root cause lies in the use of Lodash's template engine for processing connection configuration strings. Lodash templates support arbitrary JavaScript execution through expressions like ${...} or <%= ... %>, making them dangerous when processing user-controlled input. The application failed to implement proper input sanitization or use a safe template engine designed for untrusted input.

Attack Vector

The attack is network-accessible and requires high privileges (authenticated access). An attacker must have valid credentials to access the connection test endpoint. Once authenticated, they can inject malicious template expressions into connection configuration fields. When the application processes these templates during a connection test, the injected code executes on the server with the privileges of the SQLPad process.

The security patch replaced the vulnerable Lodash template processing with Mustache, a logic-less template engine that does not evaluate arbitrary code:

-const _ = require('lodash');
+const mustache = require('mustache');
+
+// Disable HTML escaping. We're not using it for HTML
+mustache.escape = function (text) {
+  return text;
+};
 
 /**
  * Iterates over connection object, replacing any template strings with values from user

Source: GitHub Commit

Detection Methods for CVE-2022-0944

Indicators of Compromise

• Unusual connection test requests containing template syntax characters such as ${, <%=, or %>
• Unexpected process spawning from the SQLPad application process
• Anomalous outbound network connections originating from the SQLPad server
• Error logs containing template parsing errors or JavaScript execution traces

Detection Strategies

• Monitor SQLPad application logs for connection test operations with suspicious payload patterns
• Implement web application firewall (WAF) rules to detect template injection attempts in HTTP request bodies
• Deploy endpoint detection to identify unauthorized child processes spawned by the SQLPad service
• Enable audit logging for all connection configuration changes and test operations

Monitoring Recommendations

• Review SQLPad access logs for unusual authentication patterns or privilege escalation attempts
• Monitor file system integrity on servers running SQLPad for unauthorized modifications
• Track network connections from SQLPad servers to detect potential data exfiltration or reverse shell activity
• Set up alerts for any new user account creation or permission changes within SQLPad

How to Mitigate CVE-2022-0944

Immediate Actions Required

• Upgrade SQLPad to version 6.10.1 or later immediately
• Review SQLPad access logs for any suspicious connection test activity prior to patching
• Audit user accounts with access to SQLPad and remove unnecessary privileges
• Consider temporarily restricting network access to the SQLPad instance until patching is complete

Patch Information

The vulnerability has been addressed in SQLPad version 6.10.1. The fix replaces the vulnerable Lodash template engine with Mustache, a logic-less template system that prevents code injection. The patch is available in commit 3f92be386c6cd3e5eba75d85f0700d3ef54daf73. Organizations should update to version 6.10.1 or later by pulling the latest release from the official SQLPad GitHub repository.

Workarounds

• Restrict access to the SQLPad application to trusted users only via network segmentation or access controls
• Implement a reverse proxy with WAF capabilities to filter potentially malicious template syntax from requests
• Disable or restrict access to the connection test functionality if not operationally required
• Run SQLPad in a containerized environment with minimal privileges to limit blast radius in case of exploitation

# Configuration example
# Restrict SQLPad access via firewall rules (example using iptables)
iptables -A INPUT -p tcp --dport 3000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP

# Run SQLPad with limited user privileges
useradd -r -s /bin/false sqlpad
chown -R sqlpad:sqlpad /opt/sqlpad
su -s /bin/bash -c "node /opt/sqlpad/server.js" sqlpad