Executive brief
waterline-sequel is a Node.js library for database query building used in Sails.js applications. It is vulnerable to SQL injection when user-supplied input is passed to string matching methods (like, contains, startsWith, endsWith). An attacker can inject arbitrary SQL commands to bypass authentication, extract sensitive data, or modify database records.
Technical details
The vulnerability is a SQL injection (CWE-89) in waterline-sequel versions prior to 0.5.1, affecting the like, contains, startsWith, and endsWith query methods. The root cause is insufficient input sanitization when constructing SQL queries; user input is concatenated directly into SQL without proper prepared statement use or parameterized queries. The attack vector is network-based, requiring only the ability to send HTTP requests to a Sails.js application exposing default blueprints. An attacker can inject SQL metacharacters (e.g., backslashes and quotes) to alter query logic and extract or modify data. The fix is to upgrade to version 0.5.1 or later.
Affected products
- Waterline waterline-sequel < 0.5.1
Timeline
- 2015-11: disclosed: Vulnerability reported on GitHub issue #1219
- 2016: patched: Fixed in waterline-sequel 0.5.1
- 2019-02-18: advisory: GHSA-cgpp-wm2h-6hqx published