Executive brief
Sequelize is a popular Node.js library used by developers to interact with databases such as PostgreSQL, MySQL, and SQL Server. A SQL injection vulnerability in how Sequelize handles array parameters allows attackers to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. This affects applications using Sequelize to build database queries with user-supplied data.
Technical details
The vulnerability exists in Sequelize's handling of array parameters in parameterized queries. When arrays are passed as parameter values (e.g., in an IN clause), Sequelize casts them to strings and fails to properly escape the resulting SQL, allowing SQL injection. An attacker can craft malicious array elements containing SQL metacharacters to break out of the intended query context. The flaw affects PostgreSQL, SQLite, and Microsoft SQL Server. The attack requires the application to accept user input and pass it directly to Sequelize's query() method as a replacement parameter. Patches are available in version 3.20.0 and later.
Affected products
- Sequelize Sequelize <3.20.0
Timeline
- 2016-03-29: disclosed: Issue reported on GitHub
- 2016: patched: Fixed in version 3.20.0
- 2019-02-18: advisory: GHSA-9c2p-jw8p-f84v published