Executive brief
Sequelize is a popular Node.js library that helps developers query databases using JavaScript. A vulnerability in the json() function allows attackers to inject malicious SQL code if an application passes unsanitized user input to JSON queries. An attacker can exploit this to read, modify, or delete data from the underlying database.
Technical details
The sequelize.json() function incorrectly formats sub-paths for JSON queries, failing to properly escape user-supplied input. The vulnerability is classified as SQL Injection (CWE-89). An attacker can pass specially crafted input to the json() function that breaks out of the intended query context and injects arbitrary SQL statements. The attack requires network access to an application using the vulnerable library and the ability to control input passed to the json() query function. Exploitation allows execution of arbitrary SQL commands with the privileges of the database connection. Patches are available in sequelize 4.44.3 and later, and sequelize 5.15.1 and later.
Affected products
- Sequelize sequelize versions before 4.44.3 and 5.0.0 before 5.15.1
Timeline
- 2019-10-25: disclosed
- 2019-08-18: patched: Fixes merged into master branch