⬇ Download holy card: ·
Saint ORM Leaks, Who Filtered Out the Database's Secrets
Patron of ORMs, over-generous filters, and APIs that answer more than they should.
Life
In June 2024 Alex Brown of elttam described a class of flaws in ORMs, from Django to Strapi: when user input reaches the query filters, you can traverse the relations between tables and query columns never meant to be exposed. By comparing responses one character at a time, you infer password hashes and reset tokens. Not a single bug, but a crooked way of thinking, with a handful of CVEs in its wake.
Prayer
O Saint ORM Leaks, who makes the database confess what it meant to keep, teach our filters to pass only the right fields. Amen.
How to celebrate
Celebrated by allow-listing the filterable fields and updating Strapi and the other frameworks that were hit.
A generous filter makes a talkative database.