Executive brief
Sequelize, a popular database tool for Node.js, is vulnerable to SQL injection. This flaw allows attackers to bypass security measures and interact directly with the underlying database by providing malicious input to specific search functions. An exploit could lead to unauthorized data access, modification of records, or complete database compromise.
Technical details
Sequelize versions 2.1.3 and earlier are vulnerable to SQL injection (CWE-89). The vulnerability occurs when untrusted user input is passed directly into the `findOne` method or into a `where` clause (e.g., `where: "user input"`). Because the library fails to properly neutralize special SQL elements in these specific contexts, a remote attacker can inject arbitrary SQL commands. This can be exploited over the network without authentication to read, modify, or delete data across various supported databases including MySQL, Postgres, and SQLite. The issue is resolved in version 3.0.0, which introduces breaking changes to how queries are handled.
Affected products
- sequelizejs sequelize <= 2.1.3
Timeline
- 2016-10-05: disclosed: Vulnerability identified/reported via HackerOne
- 2018-05-31: advisory: NVD published CVE-2016-10553
- 2019-02-18: advisory: GitHub Advisory published GHSA-2v7q-2xqx-f4q5