---

Beekeeper Studio is a popular open-source SQL editor and database manager, loved by many developers for its ease of use. But in version 3.6.6, it suffered from a critical security flaw: CVE-2022-43143, a Cross-Site Scripting (XSS) vulnerability. This bug allowed attackers to inject malicious code through the app’s error modal, potentially leading to stolen data, session hijacking, or further compromise.

In this long read, we’ll break down how CVE-2022-43143 works, show you the code behind it, demonstrate a proof-of-concept exploit, and share ways to stay safe. Whether you’re a developer or a curious user, follow along!

What Is CVE-2022-43143?

CVE-2022-43143 is a Cross-Site Scripting (XSS) vulnerability in Beekeeper Studio version 3.6.6. It lets attackers inject and execute arbitrary JavaScript or HTML content in a user’s browser via a crafted payload. This happens when error messages are displayed without proper sanitization in the app's error modal container.

- Vulnerable app: Beekeeper Studio

Affected version: v3.6.6 (and possibly earlier)

- CVE entry: CVE-2022-43143 on Mitre

Why Is This Problematic?

If attackers can control error messages, they can inject code like <script>alert('XSS')</script>. When the modal displays this error, the script runs in the context of the user. This could let attackers:

How Does The Vulnerability Work?

The error modal in Beekeeper Studio is responsible for showing errors from user input, such as SQL query errors. If the content of the error isn’t properly escaped or sanitized, any HTML code in the error will be rendered as actual HTML.

Example scenario:

Let’s say the error modal displays the following error

<div class="error-modal">
  <p>Error: [Error message here]</p>
</div>

If an attacker can inject their own input into [Error message here], and the value isn’t escaped, their HTML or JavaScript runs as part of the application UI.

Code Snippet: Demonstrating the Bug

Below is a simplified (pseudo-code) snippet showing vulnerable code in the error modal rendering logic:

function showErrorModal(errorMessage) {
  // BAD: Directly inserting the message, no HTML sanitization!
  const errorModal = document.getElementById('error-modal-container');
  errorModal.innerHTML = `
    <div class="modal">
      <h2>Error Occurred</h2>
      <p>${errorMessage}</p>
    </div>
  `;
}

If errorMessage comes from user input and contains malicious code, like

<script>alert('XSS')</script>

It would be rendered and executed

<div class="modal">
  <h2>Error Occurred</h2>
  <p><script>alert('XSS')</script></p>
</div>

Proof of Concept (PoC): Exploiting The Vulnerability

Here’s a step-by-step breakdown of how an attacker might exploit CVE-2022-43143.

`sql

SELECT * FROM "alert('Hacked!')";

Trigger Error Modal:

Beekeeper Studio passes the error message up to the error-modal component—without escaping the input.

Below is a simple PoC script showing the impact

// Simulate how an error message received from a user-controlled input gets rendered.
function vulnerableShowError(errorMessage) {
  // Vulnerable code—direct innerHTML assignment!
  document.body.innerHTML += `
    <div id="error-modal">
      <h2>Error Occurred</h2>
      <p>${errorMessage}</p>
    </div>
  `;
}

// Malicious attacker input
let attackerInput = &lt;img src=&quot;invalid.jpg&quot; onerror=&quot;alert(&#039;XSS achieved!&#039;)&quot;&gt;;

// Trigger the vulnerability
vulnerableShowError(attackerInput);

Result: The attacker’s <img> tag triggers the onerror handler and an alert pops up.

Official References

- CVE-2022-43143 on NVD
- GitHub Security Advisory (GHSA-hrw5-hmj7-qvx6)
- Beekeeper Studio Releases
- OWASP XSS Introduction


## How to Fix / Protect Yourself

Beekeeper Studio quickly patched this flaw in later releases. If you’re still using v3.6.6 or earlier, upgrade immediately.

For developers: Always sanitize and escape user input before rendering in the UI. For example

function escapeHtml(str) {
  return str
    .replace(/&/g, "&amp;")
    .replace(/</g, "&lt;")
    .replace(/>/g, "&gt;")
    .replace(/"/g, "&quot;")
    .replace(/'/g, "&#039;");
}

function showErrorModalSafe(errorMessage) {
  const errorModal = document.getElementById('error-modal-container');
  errorModal.innerHTML = `
    <div class="modal">
      <h2>Error Occurred</h2>
      <p>${escapeHtml(errorMessage)}</p>
    </div>
  `;
}

Developers must sanitize any data presented in the UI.

Thanks for reading! Stay safe, keep your tools updated, and never trust user input.

Exclusive note: This post is meant for educational purposes and responsible disclosure. Always test vulnerabilities in your own environments and avoid harming others.


*References:*
- CVE-2022-43143 at NVD
- Beekeeper Studio GitHub Security Advisory

Timeline

Published on: 11/21/2022 21:15:00 UTC
Last modified on: 11/22/2022 15:57:00 UTC