When an application allows client-controlled data to be passed into distinctOn, an attacker can supply arbitrary SQL fragments, including correlated subqueries. This provides a mechanism for attackers to perform blind SQL injection, exfiltrating data the application's database role can access through boolean or time-based inference. Because this occurs within a parenthesized SQL expression list, the impact is significant for any Node.js application relying on TypeORM for database interactions that dynamically handles query parameters from user inputs.

Impact

The vulnerability allows unauthorized access to data stored in the database, potentially leading to full information disclosure if the application database role has sufficient permissions. An attacker can use this flaw to exfiltrate data from any reachable table by observing the timing or boolean responses of the application. This affects any application using TypeORM that dynamically generates distinct-on clauses based on untrusted user input.

Recommendation

• Audit all occurrences of SelectQueryBuilder.distinctOn in the codebase to identify instances where user-controlled input is passed directly to the function.
• Implement strict input validation or mapping to a static allowlist of column names before passing values to distinctOn.
• Upgrade TypeORM to a patched version once released by the maintainers that ensures input sanitization or proper escaping within the distinctOn method.
• Review database role permissions to ensure the application follows the principle of least privilege, minimizing the blast radius of a successful SQL injection attack.