Deno Database Permission Bypass Vulnerability in SQLite Integration

A vulnerability exists in Deno versions 2.2.0 prior to 2.2.5, allowing users to bypass the runtime's read and write database permission checks. This is achieved by using the 'ATTACH DATABASE' statement within the 'node:sqlite' module. The issue has been addressed in Deno version 2.2.5.

Impact

Exploitation of this vulnerability allows for unauthorized read and write operations on SQLite databases, potentially leading to data manipulation or corruption.

Reproduction

To reproduce this vulnerability, create a script that imports the 'node:sqlite' module and establishes a database connection. Use the 'ATTACH DATABASE' statement to attach a new database file, bypassing Deno's permission checks. After attaching the database, it is possible to execute further SQL commands that could manipulate or access data in ways that should be restricted.

Remediation

Users can upgrade to Deno version 2.2.5 or later to address this vulnerability.