x/vulndb: potential Go vuln in github.com/navidrome/navidrome: GHSA-58vj-cv5w-v4v6

[GoVulnBot]

Advisory GHSA-58vj-cv5w-v4v6 references a vulnerability in the following Go modules:

Module
github.com/navidrome/navidrome

Description:

Security Advisory: Multiple Vulnerabilities in Navidrome

Summary

Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like password=... in the URL (ORM Leak).

Furthermore, the names of the parameters are not properly escaped, leading to SQL Injections.

Finally, the username is used in a LIKE statement, allowing people to log in with % instead of their username.

Details

ORM Leak

When adding parameters to the URL, they are automatically included in an SQL LIKE statement (depending on the par...

References:

• ADVISORY: GHSA-58vj-cv5w-v4v6
• ADVISORY: GHSA-58vj-cv5w-v4v6
• FIX: navidrome/navidrome@3107170

Cross references:

• github.com/navidrome/navidrome appears in 4 other report(s):
  • data/reports/GO-2022-0302.yaml (x/vulndb: potential Go vuln in github.com/navidrome/navidrome: CVE-2022-23857 #302)
  • data/reports/GO-2023-2414.yaml (x/vulndb: potential Go vuln in github.com/navidrome/navidrome: GHSA-wq59-4q6r-635r #2414)
  • data/reports/GO-2024-2803.yaml (x/vulndb: potential Go vuln in github.com/navidrome/navidrome: CVE-2024-32963 #2803)
  • data/reports/GO-2024-3029.yaml (x/vulndb: potential Go vuln in github.com/navidrome/navidrome: GHSA-hrmx-8jjv-g758 #3029)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/navidrome/navidrome
      versions:
        - fixed: 0.53.0
      vulnerable_at: 0.52.5
summary: Navidrome has Multiple SQL Injections and ORM Leak in github.com/navidrome/navidrome
ghsas:
    - GHSA-58vj-cv5w-v4v6
references:
    - advisory: https://github.com/advisories/GHSA-58vj-cv5w-v4v6
    - advisory: https://github.com/navidrome/navidrome/security/advisories/GHSA-58vj-cv5w-v4v6
    - fix: https://github.com/navidrome/navidrome/commit/3107170afd9f557a10f7031f23cb3c9e975a71f9
source:
    id: GHSA-58vj-cv5w-v4v6
    created: 2024-09-20T15:01:31.879529795Z
review_status: UNREVIEWED