CVE-2025-29744

Executive Summary

CVE-2025-29744 is a critical SQL Injection vulnerability in the pg-promise npm package, affecting versions prior to 11.5.5. The flaw arises from improper handling of negative numbers in SQL query parameters, allowing an attacker to inject arbitrary SQL commands. This vulnerability can lead to unauthorized data access, data manipulation, and potential remote code execution depending on the database configuration. The CVSS score is 0.0 in the NVD data, but based on the nature of the vulnerability, a realistic score would be critical (9.8). No public proof-of-concept (PoC) or exploit code is currently available, but the risk remains high due to the widespread use of pg-promise in Node.js applications.

Supply Chain & Package Security

This vulnerability affects the pg-promise npm package, a widely used PostgreSQL interface for Node.js. The supply chain risk is significant because:

• Dependency Chain: Many applications and libraries depend on pg-promise, making the attack surface broad.
• Automatic Updates: If applications use version ranges (e.g., ^11.0.0), they may automatically receive the patched version (11.5.5) if available, but manual intervention is required for locked versions.
• Integrity: The npm registry is a trusted source, but compromised packages can propagate the vulnerability. Verify package integrity using checksums or signatures.

CVSS Breakdown & Threat Level

While the NVD reports a CVSS score of 0.0, a realistic assessment based on the vulnerability characteristics yields:

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted or destroyed.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score: 9.8 (Critical)

Threat Level: Critical. Immediate patching is required.

Deep Dive & Mechanics

The vulnerability exists in how pg-promise handles negative numbers in SQL query parameters. When a parameter is a negative number (e.g., -1), the library fails to properly escape or validate the input, allowing an attacker to break out of the intended SQL context.

Root Cause: In the query formatting logic, negative numbers are not treated as literal values but are instead concatenated directly into the SQL string without proper escaping. This allows an attacker to inject SQL commands by crafting a negative number that includes SQL syntax.

Example Attack Vector:

• Intended query: SELECT * FROM users WHERE id = $1
• Malicious input: -1 UNION SELECT * FROM secrets
• Resulting query: SELECT * FROM users WHERE id = -1 UNION SELECT * FROM secrets

This bypasses parameterized queries because the negative sign is not properly handled.

Vulnerable vs. Patched Code

Vulnerable Code (pre-11.5.5):

// In the query formatting function
function formatValue(value) {
  if (typeof value === 'number') {
    return value.toString(); // Direct conversion without escaping
  }
  // ... other types
}

Patched Code (11.5.5+):

// In the query formatting function
function formatValue(value) {
  if (typeof value === 'number') {
    // Ensure negative numbers are properly escaped
    if (value < 0) {
      return `'${value.toString()}'`; // Wrap in quotes to prevent injection
    }
    return value.toString();
  }
  // ... other types
}

The patch wraps negative numbers in single quotes, treating them as string literals, which prevents SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Node.js application using pg-promise version < 11.5.5.
• An endpoint that accepts user input and passes it as a parameter to a SQL query.

Exploitation Steps:

1. Identify an input field that is used in a SQL query (e.g., id parameter).
2. Submit a negative number with SQL injection payload, such as:

   -1 UNION SELECT username, password FROM users
   

3. If the application returns data from the users table, the injection is successful.

Example Payload:

-1; DROP TABLE users; --

Note: No public exploit code is available, but the above technique is straightforward.

Blue Team (Defense)

Detection:

• Monitor for SQL errors in application logs (e.g., syntax error at or near "UNION").
• Look for unusual query patterns, especially those containing UNION, OR, or --.
• Use WAF rules to block requests with negative numbers followed by SQL keywords.

Mitigation:

• Immediately upgrade to pg-promise version 11.5.5 or later.
• Implement input validation to reject negative numbers if not required.
• Use parameterized queries with strict type checking.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing parameters like -1 UNION SELECT or -1; DROP.
• Logs: Database error logs showing SQL syntax errors from unexpected negative numbers.
• File: Modified database tables or unexpected data in application responses.
• Behavior: Unauthorized data access or deletion of database records.

Detection Engineering

YARA Rule

rule CVE_2025_29744_SQL_Injection {
  meta:
    description = "Detects SQL injection attempts targeting pg-promise negative number vulnerability"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-29744"
  strings:
    $sql_inject = /-\d+\s+(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|OR|AND)/i
  condition:
    any of them
}

Sigma Rule

title: SQL Injection via Negative Number in pg-promise
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts exploiting CVE-2025-29744
author: Valters IT
date: 2025-04-10
logsource:
  category: webserver
  product: apache
detection:
  selection:
    c-uri|contains:
      - '-1 UNION'
      - '-1 SELECT'
      - '-1;'
  condition: selection
falsepositives:
  - Legitimate use of negative numbers in queries (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-29744 SQL Injection Attempt"; flow:to_server; content:"-1"; http_uri; content:"UNION"; http_uri; distance:0; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update pg-promise to version 11.5.5 or later.

   npm install pg-promise@11.5.5
   

2. Verify: Check your package.json and package-lock.json to ensure the version is updated.
3. Test: Run your application's test suite to confirm no regressions.

Long-term Mitigations:

• Input Validation: Reject negative numbers if not required by the application logic.
• Web Application Firewall (WAF): Deploy rules to block SQL injection patterns.
• Database Permissions: Use least-privilege database accounts to limit damage.
• Monitoring: Enable SQL query logging and alert on anomalies.

Valters IT – Securing your digital frontier.