Is CVE-2016-10554 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-10554 being exploited in the wild.

How severe is CVE-2016-10554?

Informational severity, with a CVSS score of 0, published 18 February 2019.

Which products and versions are affected?

sequelize (npm) SEMVER:introduced=0,fixed=1.7.0.

Is there a fix for CVE-2016-10554?

Yes. sequelize (npm): upgrade to 1.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-10554 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-10554?

Check whether you run sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-10554: Sequelize SQL injection in SQLite escape handling

CVE-2016-10554 · Severity: info · CVSS 0 · Published 2019-02-18

Sequelize is a popular database abstraction library for Node.js applications. When connecting to SQLite databases, the library incorrectly used MySQL's string escape syntax instead of SQLite's syntax, allowing attackers to inject malicious SQL code and potentially read, modify, or delete data in the database.

Technologies: sequelize (npm). Vendors: npm.

Quick answers

Is CVE-2016-10554 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-10554 being exploited in the wild.
How severe is CVE-2016-10554?: Informational severity, with a CVSS score of 0, published 18 February 2019.
Which products and versions are affected?: sequelize (npm) SEMVER:introduced=0,fixed=1.7.0.
Is there a fix for CVE-2016-10554?: Yes. sequelize (npm): upgrade to 1.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-10554 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-10554?: Check whether you run sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

sequelize (npm): upgrade to 1.7.0 or later
```
npm install sequelize@1.7.0
```

Technical details

The vulnerability is a SQL injection flaw (CWE-89) in Sequelize's string escaping logic. The root cause is that the library defaulted to MySQL's backslash-based escape syntax when handling SQLite connections, but SQLite actually uses PostgreSQL-style escaping. This mismatch allows specially crafted input strings to break out of intended query constraints. The vulnerability affects all versions prior to 1.7.0-alpha3. An attacker can exploit this by providing malicious input to any Sequelize query that accepts user-supplied data without proper validation, potentially extracting or modifying database contents.

Affected products

Sequelize Sequelize prior to 1.7.0-alpha3

Identifiers

CVE-2016-10554
GHSA-x2jc-pwfj-h9p3

Timeline

2019-02-18: disclosed
2016: patched: Fix committed to repository; version 1.7.0-alpha3 or later contains the patch

References

https://github.com/sequelize/sequelize/commit/c876192aa6ce1f67e22b26a4d175b8478615f42d

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.