Summary
Payload CMS contains a SQL injection vulnerability in certain collection fields when crafted field paths and operators are processed without sufficient query-safety controls. An attacker with read and create or update access to an affected collection may manipulate database queries, while collections without JSON or eligible blocks fields are not affected.
Payload CMS contains a SQL injection vulnerability in certain collection fields when crafted field paths and operators are processed without sufficient query-safety controls. An attacker with read and create or update access to an affected collection may manipulate database queries, while collections without JSON or eligible blocks fields are not affected.
Affected context
The vulnerability occurs in Payload CMS collections that contain a JSON field or a blocks field with blocksAsJSON enabled. Exploitation depends on the database adapter and query-processing path accepting attacker-controlled field paths or operators. Collections that do not contain these field types, and richText fields, are outside the described affected context.
The vulnerability occurs in Payload CMS collections that contain a JSON field or a blocks field with blocksAsJSON enabled. Exploitation depends on the database adapter and query-processing path accepting attacker-controlled field paths or operators. Collections that do not contain these field types, and richText fields, are outside the described affected context.
Exploit preconditions
- Attack surface: Collection query and data-management interfaces
- Required access: Read access plus create or update access to an affected collection
- Affected configuration: A collection containing a JSON field or a blocks field with
blocksAsJSONenabled - Trigger point: Processing a request containing a crafted field path and query operators
- Why exploitation is possible: Input is incorporated into database query construction without adequately restricting field paths and operator semantics
- Attack surface: Collection query and data-management interfaces
- Required access: Read access plus create or update access to an affected collection
- Affected configuration: A collection containing a JSON field or a blocks field with
blocksAsJSONenabled - Trigger point: Processing a request containing a crafted field path and query operators
- Why exploitation is possible: Input is incorporated into database query construction without adequately restricting field paths and operator semantics
Why this happens
The underlying defect is insufficient separation between user-controlled query input and trusted database query structure. Crafted field paths and operators can influence SQL generation for supported JSON-related fields, allowing input to alter the intended query rather than being treated strictly as data. This behavior maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly called SQL injection.
The underlying defect is insufficient separation between user-controlled query input and trusted database query structure. Crafted field paths and operators can influence SQL generation for supported JSON-related fields, allowing input to alter the intended query rather than being treated strictly as data. This behavior maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly called SQL injection.
Potential impact
- An attacker may bypass intended query restrictions
- Sensitive records could be disclosed
- Data could be modified, inserted, or deleted
- Database integrity and application behavior could be affected
- In some deployments, broader compromise may occur through database privileges or exposed database functionality
- An attacker may bypass intended query restrictions
- Sensitive records could be disclosed
- Data could be modified, inserted, or deleted
- Database integrity and application behavior could be affected
- In some deployments, broader compromise may occur through database privileges or exposed database functionality
General mitigation guidance
Mitigation generally focuses on ensuring that all query structure is controlled by trusted application logic.
Common defensive patterns include:
- Constructing SQL through parameterized queries and well-tested query-builder abstractions
- Allowlisting field names, paths, operators, and relationship traversal rules
- Treating JSON paths and blocks-related query expressions as structured data rather than raw SQL fragments
- Applying schema-aware validation before query construction
- Limiting collection permissions to the minimum required read and write capabilities
- Using database accounts with least privilege and separating application data access from administrative operations
- Preserving safe defaults for collection field configuration and avoiding unnecessary query features
Mitigation generally focuses on ensuring that all query structure is controlled by trusted application logic.
Common defensive patterns include:
- Constructing SQL through parameterized queries and well-tested query-builder abstractions
- Allowlisting field names, paths, operators, and relationship traversal rules
- Treating JSON paths and blocks-related query expressions as structured data rather than raw SQL fragments
- Applying schema-aware validation before query construction
- Limiting collection permissions to the minimum required read and write capabilities
- Using database accounts with least privilege and separating application data access from administrative operations
- Preserving safe defaults for collection field configuration and avoiding unnecessary query features
How teams detect issues like this
Detection approaches can include:
- Static analysis for string concatenation or interpolation of request-controlled values into SQL or query fragments
- Code review of JSON-path, blocks-field, operator, and dynamic filter handling
- Tests that submit unexpected field paths and operators and verify that they are rejected or safely parameterized
- Runtime monitoring for anomalous query errors, unusual filter structures, and unexpected access to sensitive records
- Policy enforcement requiring parameterized database access and allowlisted query operators
- Automated security scanning and code-review tools that identify injection-prone query construction
Detection approaches can include:
- Static analysis for string concatenation or interpolation of request-controlled values into SQL or query fragments
- Code review of JSON-path, blocks-field, operator, and dynamic filter handling
- Tests that submit unexpected field paths and operators and verify that they are rejected or safely parameterized
- Runtime monitoring for anomalous query errors, unusual filter structures, and unexpected access to sensitive records
- Policy enforcement requiring parameterized database access and allowlisted query operators
- Automated security scanning and code-review tools that identify injection-prone query construction
