From e86dbafb5e893c02a2fcd82ab1a85486ffa1715a Mon Sep 17 00:00:00 2001 From: bhanuc Date: Fri, 30 Oct 2026 21:52:54 -0700 Subject: [PATCH 1/2] Add advisory for postrust-core (GHSA-fcc3-v946-gfrr) Co-Authored-By: Claude Opus 5.5 --- crates/postrust-core/RUSTSEC-0000-0000.md | 36 +++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 crates/postrust-core/RUSTSEC-0000-0000.md diff --git a/crates/postrust-core/RUSTSEC-0000-0000.md b/crates/postrust-core/RUSTSEC-0000-0000.md new file mode 100644 index 000000000..8446d79f6 --- /dev/null +++ b/crates/postrust-core/RUSTSEC-0000-0000.md @@ -0,0 +1,36 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "postrust-core" +date = "2026-10-30" +url = "https://github.com/postrust/postrust/security/advisories/GHSA-fcc3-v946-gfrr" +references = ["https://github.com/postrust/postrust/releases/tag/v2.4.1"] +categories = ["format-injection"] +keywords = ["sql-injection", "postgrest"] +aliases = ["GHSA-fcc3-v946-gfrr"] +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" + +[versions] +patched = [">= 2.4.1"] +unaffected = ["< 1.0.0-alpha.1"] +``` + +# SQL injection through the type name of a cast in `select` + +The type name after `::` in a `select` cast (for example +`?select=price::text`) was written into the generated SQL statement as the +client sent it. The parser accepted spaces in that position, so any client -- +including an anonymous one when an anonymous role is configured -- could append +SQL keywords and identifiers to the statement's SELECT list. + +The injectable characters are limited to letters, digits, `_`, `$` and spaces, +so no second statement can be stacked, and the statement still runs as the +request's database role, under its grants and row-level security. No way to +read data the role could not read anyway has been found, but one is not ruled +out. + +Version 2.4.1 parses a cast as a single type name (or one of the SQL +standard's multi-word type names, written in the standard's spelling) and +refuses anything else with 400 `PGRST100`. Upgrade `postrust-core` (and with it +`postrust-server` or `postrust-lambda`) to 2.4.1 or later; 3.0.0 is also fixed. +The Cloudflare Worker build, `postrust-worker`, is fixed in 1.0.1. From 0b970c7c912db985f4f05a5c08790766d9f0dc54 Mon Sep 17 00:00:00 2001 From: bhanuc Date: Fri, 30 Oct 2026 21:54:12 -0700 Subject: [PATCH 2/2] Point url at the fix commit Co-Authored-By: Claude Opus 5.5 --- crates/postrust-core/RUSTSEC-0000-0000.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/crates/postrust-core/RUSTSEC-0000-0000.md b/crates/postrust-core/RUSTSEC-0000-0000.md index 8446d79f6..2189095d1 100644 --- a/crates/postrust-core/RUSTSEC-0000-0000.md +++ b/crates/postrust-core/RUSTSEC-0000-0000.md @@ -3,8 +3,8 @@ id = "RUSTSEC-0000-0000" package = "postrust-core" date = "2026-10-30" -url = "https://github.com/postrust/postrust/security/advisories/GHSA-fcc3-v946-gfrr" -references = ["https://github.com/postrust/postrust/releases/tag/v2.4.1"] +url = "https://github.com/postrust/postrust/commit/6a696ba521d03b5ad329fa50076b49e18926baaf" +references = ["https://github.com/postrust/postrust/security/advisories/GHSA-fcc3-v946-gfrr", "https://github.com/postrust/postrust/releases/tag/v2.4.1"] categories = ["format-injection"] keywords = ["sql-injection", "postgrest"] aliases = ["GHSA-fcc3-v946-gfrr"]