Executive brief
Sequelize is a popular tool used by developers to interact with databases in Node.js applications. A security flaw was found where the library failed to properly configure security settings when connecting to PostgreSQL databases. This could allow an attacker to inject malicious database commands, potentially leading to unauthorized data modification or loss of data integrity.
Technical details
Sequelize versions 5.x prior to 5.3.0 are vulnerable to SQL injection when interfacing with PostgreSQL. The vulnerability stems from the library not explicitly enabling the 'standard_conforming_strings' PostgreSQL option by default. When this option is disabled, PostgreSQL treats backslashes as escape characters in string literals, which Sequelize's query generator does not properly account for. An attacker can leverage this discrepancy to break out of string literals and inject arbitrary SQL statements. The fix, introduced in version 5.3.0, ensures that 'standard_conforming_strings' is set to 'on' during the connection initialization regardless of the PostgreSQL version.
Affected products
- sequelize sequelize >= 5.0.0, < 5.3.0
Timeline
- 2019-04-10: patched: Fix merged in pull request 10746
- 2019-04-10: advisory: NVD published CVE-2019-11069
- 2019-04-11: disclosed: GitHub Advisory published
References
- https://github.com/sequelize/sequelize/pull/10746
- https://github.com/sequelize/sequelize/pull/10746/files
- https://github.com/sequelize/sequelize/commit/850c7fd04669e0fef9238b6dc4f8d6ee93ed71e9
- https://github.com/sequelize/sequelize
- https://github.com/sequelize/sequelize/blob/98cb17c17f73e2aa1792aa5a1d31216ba984b456/lib/dialects/postgres/connection-manager.js
- https://github.com/sequelize/sequelize/releases/tag/v5.3.0