CVE-2022-33171: TypeORM findOne SQL Injection Vulnerability

CVE-2022-33171 Overview

CVE-2022-33171 is a SQL Injection vulnerability in TypeORM, a popular Object-Relational Mapping (ORM) library for Node.js applications. The vulnerability exists in the findOne function, which can accept either a string (ID) or a FindOneOptions object as input. When user-controlled JSON input is parsed and passed directly to the findOne function without proper validation, attackers can craft malicious FindOneOptions objects to inject arbitrary SQL queries.

This vulnerability is particularly dangerous in modern web applications that use TypeORM as their database abstraction layer, as it can allow attackers to bypass authentication, extract sensitive data, modify database contents, or potentially gain further access to backend systems.

Critical Impact

Attackers can execute arbitrary SQL queries against the application's database by supplying crafted JSON objects to the findOne function, potentially leading to data exfiltration, authentication bypass, and database manipulation.

Affected Products

• TypeORM versions before 0.3.0 for Node.js

Discovery Timeline

• 2022-07-04 - CVE-2022-33171 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-33171

Vulnerability Analysis

The vulnerability stems from TypeORM's findOne function design, which accepts polymorphic input—either a simple string identifier or a complex FindOneOptions object. This flexibility becomes a security liability when applications pass user-controlled parsed JSON directly to the function without validating the input type.

When an application expects a simple ID string but receives a crafted FindOneOptions object containing malicious where clauses or other options, TypeORM processes these as legitimate query parameters. This allows attackers to manipulate the generated SQL query in unintended ways, including injecting SQL fragments through carefully constructed option properties.

The vulnerability is classified under CWE-89 (SQL Injection), representing a failure to properly neutralize special elements used in SQL commands. The attack is network-accessible, requires no authentication, and can be executed without user interaction, making it highly exploitable in internet-facing applications.

Note: The vendor's position is that the application is responsible for input validation, placing the burden of security on developers using the library.

Root Cause

The root cause is the lack of type enforcement in the findOne function's input parameter handling. TypeORM accepts both primitive strings and complex objects as valid inputs, and when combined with automatic JSON parsing of user input (common in Express.js and similar frameworks), attackers can substitute a string ID with a malicious object structure that manipulates query behavior.

Attack Vector

The attack exploits the network-accessible nature of web applications using TypeORM. An attacker sends a crafted HTTP request containing a JSON payload where a simple ID parameter is replaced with a complex object. When the application parses this JSON and passes it to findOne, TypeORM interprets the object as query options rather than a simple identifier, executing the attacker-controlled query parameters against the database.

For example, where an application expects { "id": "123" }, an attacker might send { "id": { "where": { "username": "admin" } } } or more complex injection payloads that manipulate the query behavior. The exact exploitation technique involves crafting FindOneOptions objects with malicious where clauses, select properties, or other TypeORM query options.

Technical details of the exploitation technique can be found in the Full Disclosure security advisory and the Packet Storm information disclosure report.

Detection Methods for CVE-2022-33171

Indicators of Compromise

• Unusual or malformed JSON objects in request parameters where simple identifiers are expected
• Database query logs showing unexpected WHERE clauses or query structures
• Authentication bypass attempts or unauthorized data access patterns
• Anomalous SQL query patterns that don't match expected application behavior

Detection Strategies

• Implement input validation logging to detect when object types are received where primitives are expected
• Monitor database query logs for SQL injection patterns and unexpected query structures
• Deploy Web Application Firewalls (WAF) with rules to detect complex JSON injection attempts
• Use application-level logging to track findOne function calls with suspicious parameter types

Monitoring Recommendations

• Enable verbose TypeORM query logging in staging/development environments to understand query patterns
• Implement runtime type checking alerts for API endpoints that use TypeORM queries
• Monitor for increased database errors that may indicate injection attempts
• Set up alerts for unusual database access patterns such as bulk data retrieval or schema queries

How to Mitigate CVE-2022-33171

Immediate Actions Required

• Upgrade TypeORM to version 0.3.0 or later where the API has been modified
• Audit all code paths where user input flows to findOne and similar TypeORM functions
• Implement strict input validation to ensure expected types before passing data to TypeORM
• Add type guards or schema validation using libraries like Zod, Joi, or class-validator

Patch Information

TypeORM version 0.3.0 includes changes that address this vulnerability. The version comparison showing the relevant changes can be found at the GitHub TypeORM Version Comparison. Upgrading to TypeORM 0.3.0 or later is the recommended remediation.

Workarounds

• Validate that the input to findOne is explicitly a primitive string or number before calling the function
• Use findOneBy method instead of findOne where possible, as it has stricter input requirements
• Implement a validation layer using TypeScript type guards to enforce input types at runtime
• Wrap TypeORM calls in a service layer that explicitly validates and sanitizes all input parameters

# Example: Upgrade TypeORM to patched version
npm update typeorm@^0.3.0
# Or with yarn
yarn upgrade typeorm@^0.3.0