Junglewise Threat Intelligence

CVE-2016-1000225: Sequelize SQL injection in GEOMETRY fields via GeoJSON

CVE-2016-1000225 · Severity: low · CVSS 3.1 · Published 2020-09-01

Technologies: Sequelize. Vendors: npm.

Executive brief

Sequelize is a popular Node.js ORM library used to interact with relational databases. Applications using Sequelize to store geographic data (latitude/longitude coordinates) via the GEOMETRY data type are vulnerable to SQL injection if user-supplied location data contains single quotes. An attacker can inject malicious SQL commands through GeoJSON documents, potentially allowing unauthorized database access, data theft, or data manipulation.

Technical details

This is a SQL injection vulnerability (CWE-89) in Sequelize's handling of GEOMETRY and GEOGRAPHY data types when processing GeoJSON documents. The root cause is inadequate input sanitization: single quotes in GeoJSON document values are not escaped before being inserted into SQL queries using ST_GeomFromGeoJSON (PostgreSQL) or GeomFromText (MySQL). An attacker can craft malicious GeoJSON with embedded single quotes to break out of the SQL string context and inject arbitrary SQL commands. The attack requires the ability to provide input that is stored in a GEOMETRY field—typically through application APIs that accept location data. No authentication bypass is required if the vulnerable endpoint is publicly accessible. The vulnerability was introduced in version 3.4.0 and fixed in version 3.23.6 through proper quote escaping in the GEOMETRY data type handler.

Affected products

  • Sequelize sequelize 3.4.0 to 3.23.5

Timeline

  • 2020-09-01: disclosed: Advisory published on GitHub Security Advisory
  • 2016-07-19: patched: Fixed in version 3.23.6 via pull requests #6302 and #6306

References

Related threats