Is CVE-2016-10553 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-10553 being exploited in the wild.

How severe is CVE-2016-10553?

Informational severity, with a CVSS score of 9.8, published 18 February 2019.

Which products and versions are affected?

sequelize (npm) SEMVER:introduced=0,fixed=3.0.0.

Is there a fix for CVE-2016-10553?

Yes. sequelize (npm): upgrade to 3.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-10553 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-10553?

Check whether you run sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-10553: Sequelize SQL injection in findOne and where clauses

CVE-2016-10553 · Severity: info · CVSS 9.8 · Published 2019-02-18

Sequelize, a popular database tool for Node.js, is vulnerable to SQL injection. This flaw allows attackers to bypass security measures and interact directly with the underlying database by providing malicious input to specific search functions. An exploit could lead to unauthorized data access, modification of records, or complete database compromise.

Technologies: sequelize (npm). Vendors: npm.

Quick answers

Is CVE-2016-10553 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-10553 being exploited in the wild.
How severe is CVE-2016-10553?: Informational severity, with a CVSS score of 9.8, published 18 February 2019.
Which products and versions are affected?: sequelize (npm) SEMVER:introduced=0,fixed=3.0.0.
Is there a fix for CVE-2016-10553?: Yes. sequelize (npm): upgrade to 3.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-10553 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-10553?: Check whether you run sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

sequelize (npm): upgrade to 3.0.0 or later
```
npm install sequelize@3.0.0
```

Technical details

Sequelize versions 2.1.3 and earlier are vulnerable to SQL injection (CWE-89). The vulnerability occurs when untrusted user input is passed directly into the `findOne` method or into a `where` clause (e.g., `where: "user input"`). Because the library fails to properly neutralize special SQL elements in these specific contexts, a remote attacker can inject arbitrary SQL commands. This can be exploited over the network without authentication to read, modify, or delete data across various supported databases including MySQL, Postgres, and SQLite. The issue is resolved in version 3.0.0, which introduces breaking changes to how queries are handled.

Affected products

sequelizejs sequelize <= 2.1.3

Identifiers

CVE-2016-10553
GHSA-2v7q-2xqx-f4q5

Timeline

2016-10-05: disclosed: Vulnerability identified/reported via HackerOne
2018-05-31: advisory: NVD published CVE-2016-10553
2019-02-18: advisory: GitHub Advisory published GHSA-2v7q-2xqx-f4q5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.