CVE-2019-10752: Sequelize SQL injection in json() function

CVE-2019-10752 · Severity: low · CVSS 3.1 · Published 2019-10-25

Sequelize is a popular Node.js library that helps developers query databases using JavaScript. A vulnerability in the json() function allows attackers to inject malicious SQL code if an application passes unsanitized user input to JSON queries. An attacker can exploit this to read, modify, or delete data from the underlying database.

Technologies: sequelize (npm). Vendors: npm.

Quick answers

Is CVE-2019-10752 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2019-10752 being exploited in the wild.
How severe is CVE-2019-10752?
Low severity, with a CVSS score of 3.1, published 25 October 2019.
Which products and versions are affected?
sequelize (npm) SEMVER:introduced=0,fixed=4.44.3.
Is there a fix for CVE-2019-10752?
Yes. sequelize (npm): upgrade to 4.44.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-10752 attacked?
It is attacked over the network.
Am I affected by CVE-2019-10752?
Check whether you run sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • sequelize (npm): upgrade to 4.44.3 or later
    npm install sequelize@4.44.3

Technical details

The sequelize.json() function incorrectly formats sub-paths for JSON queries, failing to properly escape user-supplied input. The vulnerability is classified as SQL Injection (CWE-89). An attacker can pass specially crafted input to the json() function that breaks out of the intended query context and injects arbitrary SQL statements. The attack requires network access to an application using the vulnerable library and the ability to control input passed to the json() query function. Exploitation allows execution of arbitrary SQL commands with the privileges of the database connection. Patches are available in sequelize 4.44.3 and later, and sequelize 5.15.1 and later.

Affected products

  • Sequelize sequelize versions before 4.44.3 and 5.0.0 before 5.15.1

Identifiers

  • CVE-2019-10752
  • GHSA-m9jw-237r-gvfv

Timeline

  • 2019-10-25: disclosed
  • 2019-08-18: patched: Fixes merged into master branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.