Description
Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify() interpolates into a Postgres NOTIFY statement, running stacked queries against the scheduler database.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NangoHQ | nango | < 0.71.3 | 0.71.3 |
References
- GitHub Security Advisory (GHSA-8m28-9wcj-v8ww) vendor-advisory
- https://github.com/NangoHQ/nango/commit/83f24a5a1ed2db59b6d472e49c25333dc6f28709 patch
- https://github.com/NangoHQ/nango/pull/6867 issue-tracking patch
- nango v0.71.3 Release Notes release-notes
- https://github.com/NangoHQ/nango/blob/v0.71.1/packages/orchestrator/lib/events.ts#L162 technical-description
- VulnCheck Advisory: Nango before 0.71.3 SQL Injection via Orchestrator Task Group Key third-party-advisory