Executive brief
Sequelize is a popular tool used by Node.js applications to communicate with databases. A security flaw in older versions allows attackers to bypass security protections and run unauthorized database commands when the application uses a PostgreSQL database. This could lead to the theft of sensitive customer data, unauthorized modification of records, or full database compromise.
Technical details
A SQL injection vulnerability exists in Sequelize versions prior to 3.35.1 when using the PostgreSQL dialect. The root cause is the failure to properly sanitize or escape JSON path keys within the `query-generator.js` component. Specifically, the library incorrectly concatenated user-supplied JSON keys into SQL strings using the `#>>` operator. An attacker can provide a specially crafted JSON key containing SQL fragments (e.g., using single quotes and UNION statements) to break out of the intended query structure. This allows for unauthorized data retrieval or manipulation without requiring authentication, provided the application passes user-controlled JSON keys to Sequelize's query methods. The issue is fixed in version 3.35.1 by properly escaping the path keys.
Affected products
- sequelizejs sequelize < 3.35.1
Timeline
- 2019-06-20: disclosed: Vulnerability disclosed by Snyk Security Team
- 2019-06-20: patched: Fix committed to Sequelize repository
- 2019-10-29: advisory: NVD published CVE-2019-10749