Electric Database Privacy Disclosure Vulnerability via Subset Where Clauses (GHSA-c82q-v86f-c87f)

Vulnerability Overview Vulnerability Name: Excluded columns can be inferred via subset where clauses Vulnerability ID: GHSA-c82q-v86f-c87f Severity: Low CVE ID: No known CVE Weakness: CWE-200 Reporter: geo-chen Impact Scope Affected Versions: < 1.6.10 Fixed Version: 1.6.10 Remediation Description: - Subset where clauses can reference columns that are excluded from the shape response via the parameter. - Deployments relying on to restrict access to sensitive fields may allow inference of excluded column information by observing whether conditions match. - Electric's intent is for to control which columns are synced to the client, allowing for smaller downloads and faster responses by excluding unused columns. However, the documentation describes setting the parameter as a server-side security measure to prevent clients from requesting sensitive columns, which may lead users to rely on it as a security feature. - To separate sync configuration from security configuration, a new parameter has been introduced. - Users syncing tables with sensitive columns are advised to upgrade to Postgres Sync 1.6.10. - Set to include only the columns to which the client should have access. This must be a subset of or equal to ; it cannot include columns not listed in , but it can be smaller, resulting in smaller and faster syncs. If is omitted, all columns listed in will be synced. - Note that only restricts access via where clauses. where clauses are not restricted by and should be treated as server-side configuration parameters. POC Code or Exploit Code No specific POC code or exploit code is provided on the page.

Goal Reached Thanks to every supporter — we hit 100%!

Electric Database Privacy Disclosure Vulnerability via Subset Where Clauses (GHSA-c82q-v86f-c87f)

More from this source