Is CVE-2016-1000225 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-1000225 being exploited in the wild.

How severe is CVE-2016-1000225?

Low severity, with a CVSS score of 3.1, published 1 September 2020.

Which products and versions are affected?

sequelize (npm) SEMVER:introduced=3.4.0,fixed=3.23.6.

Is there a fix for CVE-2016-1000225?

Yes. sequelize (npm): upgrade to 3.23.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-1000225 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-1000225?

Check whether you run sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-1000225: Sequelize SQL injection in GEOMETRY fields via GeoJSON

CVE-2016-1000225 · Severity: low · CVSS 3.1 · Published 2020-09-01

Sequelize is a popular Node.js ORM library used to interact with relational databases. Applications using Sequelize to store geographic data (latitude/longitude coordinates) via the GEOMETRY data type are vulnerable to SQL injection if user-supplied location data contains single quotes. An attacker can inject malicious SQL commands through GeoJSON documents, potentially allowing unauthorized database access, data theft, or data manipulation.

Technologies: sequelize (npm). Vendors: npm.

Quick answers

Is CVE-2016-1000225 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-1000225 being exploited in the wild.
How severe is CVE-2016-1000225?: Low severity, with a CVSS score of 3.1, published 1 September 2020.
Which products and versions are affected?: sequelize (npm) SEMVER:introduced=3.4.0,fixed=3.23.6.
Is there a fix for CVE-2016-1000225?: Yes. sequelize (npm): upgrade to 3.23.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-1000225 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-1000225?: Check whether you run sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

sequelize (npm): upgrade to 3.23.6 or later
```
npm install sequelize@3.23.6
```

Technical details

This is a SQL injection vulnerability (CWE-89) in Sequelize's handling of GEOMETRY and GEOGRAPHY data types when processing GeoJSON documents. The root cause is inadequate input sanitization: single quotes in GeoJSON document values are not escaped before being inserted into SQL queries using ST_GeomFromGeoJSON (PostgreSQL) or GeomFromText (MySQL). An attacker can craft malicious GeoJSON with embedded single quotes to break out of the SQL string context and inject arbitrary SQL commands. The attack requires the ability to provide input that is stored in a GEOMETRY field—typically through application APIs that accept location data. No authentication bypass is required if the vulnerable endpoint is publicly accessible. The vulnerability was introduced in version 3.4.0 and fixed in version 3.23.6 through proper quote escaping in the GEOMETRY data type handler.

Affected products

Sequelize sequelize 3.4.0 to 3.23.5

Identifiers

CVE-2016-1000225
GHSA-5v9h-q3gj-c32x

Timeline

2020-09-01: disclosed: Advisory published on GitHub Security Advisory
2016-07-19: patched: Fixed in version 3.23.6 via pull requests #6302 and #6306

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.