Executive brief
Sequelize is an Object-Relational Mapper (ORM) library used by Node.js applications to interact with databases. Vulnerable versions fail to properly sanitize JSON path keys when generating SQL queries for MariaDB and MySQL, allowing attackers to inject malicious SQL and execute arbitrary database commands. This could lead to data theft, modification, or deletion from the database.
Technical details
This is a SQL injection vulnerability (CWE-89) in the Sequelize ORM library affecting versions prior to 3.35.1, 4.44.3, and 5.8.11. The vulnerability stems from insufficient sanitization of JSON path keys in the MariaDB and MySQL dialect handlers. An attacker with network access to an application using Sequelize can craft malicious JSON path keys that break out of the intended query context and inject arbitrary SQL statements. No authentication or user interaction is required. Successful exploitation allows arbitrary SQL query execution, enabling data extraction, modification, unauthorized access, or database disruption. Patches are available in sequelize 3.35.1, 4.44.3, and 5.8.11 or later.
Affected products
- Sequelize Sequelize before 3.35.1, 4.0.0 before 4.44.3, 5.0.0 before 5.8.11
Timeline
- 2019-11-06: disclosed
- 2019-11-06: patched: Patches released for versions 3.35.1, 4.44.3, and 5.8.11