# Object injection in `stripe-billing-typographic` GitHub project via /auth/login

Object injection in Stripe's stripe-billing-typographic login lets a JSON object reach the SQL query, bypassing authentication with only a valid password.

- Payout: hidden
- Severity: low
- Program: Stripe
- Found by: ph0r3nsic
- Disclosed: 2023-03-06
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1183335
- Library page: https://bugbountylibrary.com/r/h1%3A1183335
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:low tech:nodejs technique:source-review vuln:auth-bypass vuln:sqli

**Target:** /auth/login endpoint of stripe-billing-typographic (Node.js/MySQL/Knex)
**Root cause:** The login handler passes the raw JSON body's email object into a Knex/MySQL query; the sqlstring dependency stringifies the object's braces into backticks, producing `email`=`email`=1 which evaluates true.
**Steps:**
1. Register a user with known password, e.g. test@test.com / 123.
2. Send `POST /auth/login` with body `{"email":{"email":1},"password":"1234"}`.
3. Observe login succeeds without a valid matching user because the query becomes `SELECT * FROM accounts WHERE \`email\`=\`email\`=1`.
**How found:** Researcher noticed the login handler passed the parsed JSON body directly to the query builder and reasoned that the sqlstring dependency's brace-to-backtick escaping would corrupt the query, then tested with an object payload.
**Exploitation:** Attacker submits a JSON object as the email field; sqlstring converts braces to backticks yielding a tautological WHERE clause, authenticating as any account whose password is known/guessed.
**Insight:** When a Node app passes parsed JSON objects (not strings) into Knex/MySQL, sqlstring's brace-to-backtick escaping can turn nested objects into tautologies; try object-shaped params on auth queries.