Saint ORM Leaks, Who Filtered Out the Database's Secrets

Patron of ORMs, over-generous filters, and APIs that answer more than they should.

Life

In June 2024 Alex Brown of elttam described a class of flaws in ORMs, from Django to Strapi: when user input reaches the query filters, you can traverse the relations between tables and query columns never meant to be exposed. By comparing responses one character at a time, you infer password hashes and reset tokens. Not a single bug, but a crooked way of thinking, with a handful of CVEs in its wake.

Prayer

O Saint ORM Leaks, who makes the database confess what it meant to keep, teach our filters to pass only the right fields. Amen.

How to celebrate

Celebrated by allow-listing the filterable fields and updating Strapi and the other frameworks that were hit.

A generous filter makes a talkative database.