CVE-2020-4035 : What You Need to Know

WatermelonDB (NPM package "@nozbe/watermelondb") before versions 0.15.1 and 0.16.2 is vulnerable to a SQL Injection issue that can lead to denial of service (DoS) or local data modification.

Understanding CVE-2020-4035

In this CVE, a maliciously crafted record ID can exploit a SQL Injection vulnerability in the iOS adapter implementation of WatermelonDB, potentially causing severe consequences for affected applications.

What is CVE-2020-4035?

The vulnerability allows an attacker to manipulate record IDs, leading to SQL Injection in the database.
Affected versions are < 0.15.1 and >= 0.16.0, < 0.16.2 of WatermelonDB.

The Impact of CVE-2020-4035

Attack Complexity: High
Attack Vector: Network
Availability Impact: High
Base Score: 5.9 (Medium)
Integrity Impact: Low
Privileges Required: Low
No breach of confidentiality is known.

Technical Details of CVE-2020-4035

WatermelonDB vulnerability details:

Vulnerability Description

Malicious record IDs can trigger SQL Injection, potentially leading to data deletion and app instability.

Affected Systems and Versions

WatermelonDB versions < 0.15.1 and >= 0.16.0, < 0.16.2.

Exploitation Mechanism

Lack of ID validation and usage of specific methods can be exploited to delete records.

Mitigation and Prevention

Protect your systems from CVE-2020-4035:

Immediate Steps to Take

Update WatermelonDB to patched versions 0.15.1, 0.16.2, or 0.16.1-fix.
Validate record IDs to prevent SQL Injection.

Long-Term Security Practices

Regularly audit and secure database interactions.
Educate developers on secure coding practices.

Patching and Updates

Stay informed about security advisories and apply patches promptly.