Executive brief
Sequelize is a popular Node.js ORM (Object-Relational Mapping) library used to interact with databases. A SQL injection vulnerability exists in the limit and order query parameters, allowing attackers who control these inputs to inject arbitrary SQL code and potentially access, modify, or delete database records.
Technical details
The vulnerability is a SQL injection (CWE-89) in the limit and order parameters of Sequelize query methods such as findOne() and findAll(). The root cause is insufficient escaping of user-supplied values passed to these parameters before incorporation into SQL statements. An attacker able to influence these parameters can inject malicious SQL fragments. The attack requires control over the limit or order parameter values in a query call. Patches were applied to escape these arguments, and the vulnerability is fixed in version 3.17.0 and later.
Affected products
- Sequelize Sequelize before 3.17.0
Timeline
- 2019-02-18: disclosed
- 2016-01-06: patched: Fix merged in Pull Request #5167