Is CVE-2019-10749 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-10749 being exploited in the wild.

How severe is CVE-2019-10749?

Low severity, with a CVSS score of 3.1, published 8 November 2019.

Which products and versions are affected?

sequelize (npm) SEMVER:introduced=0,fixed=3.35.1.

Is there a fix for CVE-2019-10749?

Yes. sequelize (npm): upgrade to 3.35.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-10749 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-10749?

Check whether you run sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-10749: Sequelize SQL injection in Postgres JSON path keys

CVE-2019-10749 · Severity: low · CVSS 3.1 · Published 2019-11-08

Sequelize is a popular tool used by Node.js applications to communicate with databases. A security flaw in older versions allows attackers to bypass security protections and run unauthorized database commands when the application uses a PostgreSQL database. This could lead to the theft of sensitive customer data, unauthorized modification of records, or full database compromise.

Technologies: sequelize (npm). Vendors: npm.

Quick answers

Is CVE-2019-10749 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-10749 being exploited in the wild.
How severe is CVE-2019-10749?: Low severity, with a CVSS score of 3.1, published 8 November 2019.
Which products and versions are affected?: sequelize (npm) SEMVER:introduced=0,fixed=3.35.1.
Is there a fix for CVE-2019-10749?: Yes. sequelize (npm): upgrade to 3.35.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-10749 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-10749?: Check whether you run sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

sequelize (npm): upgrade to 3.35.1 or later
```
npm install sequelize@3.35.1
```

Technical details

A SQL injection vulnerability exists in Sequelize versions prior to 3.35.1 when using the PostgreSQL dialect. The root cause is the failure to properly sanitize or escape JSON path keys within the `query-generator.js` component. Specifically, the library incorrectly concatenated user-supplied JSON keys into SQL strings using the `#>>` operator. An attacker can provide a specially crafted JSON key containing SQL fragments (e.g., using single quotes and UNION statements) to break out of the intended query structure. This allows for unauthorized data retrieval or manipulation without requiring authentication, provided the application passes user-controlled JSON keys to Sequelize's query methods. The issue is fixed in version 3.35.1 by properly escaping the path keys.

Affected products

sequelizejs sequelize < 3.35.1

Identifiers

CVE-2019-10749
GHSA-2598-2f59-rmhq

Timeline

2019-06-20: disclosed: Vulnerability disclosed by Snyk Security Team
2019-06-20: patched: Fix committed to Sequelize repository
2019-10-29: advisory: NVD published CVE-2019-10749

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.