Is CVE-2022-2422 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-2422 being exploited in the wild.

How severe is CVE-2022-2422?

Low severity, with a CVSS score of 3.1, published 26 October 2022.

Which products and versions are affected?

feathers-sequelize (npm) SEMVER:introduced=6.0.0,fixed=6.3.4.

Is there a fix for CVE-2022-2422?

Yes. feathers-sequelize (npm): upgrade to 6.3.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-2422 attacked?

It is attacked over the network.

Am I affected by CVE-2022-2422?

Check whether you run feathers-sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-2422: feathers-sequelize SQL injection via improper input validation

CVE-2022-2422 · Severity: low · CVSS 3.1 · Published 2022-10-26

feathers-sequelize is a Node.js library that provides database access for Feathers applications using Sequelize ORM. Due to improper input validation, attackers can inject arbitrary SQL commands into database queries, potentially reading, modifying, or deleting sensitive data. This vulnerability affects web applications that use the vulnerable library versions to handle untrusted user input.

Technologies: feathers-sequelize (npm). Vendors: npm.

Quick answers

Is CVE-2022-2422 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-2422 being exploited in the wild.
How severe is CVE-2022-2422?: Low severity, with a CVSS score of 3.1, published 26 October 2022.
Which products and versions are affected?: feathers-sequelize (npm) SEMVER:introduced=6.0.0,fixed=6.3.4.
Is there a fix for CVE-2022-2422?: Yes. feathers-sequelize (npm): upgrade to 6.3.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-2422 attacked?: It is attacked over the network.
Am I affected by CVE-2022-2422?: Check whether you run feathers-sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

feathers-sequelize (npm): upgrade to 6.3.4 or later
```
npm install feathers-sequelize@6.3.4
```

Technical details

The vulnerability stems from CWE-89 (SQL Injection) caused by improper input validation in feathers-sequelize versions 6.0.0 through 6.3.3. The flaw allows attackers to inject raw SQL through attribute selection parameters in database queries without proper sanitization. An unauthenticated attacker over the network can craft malicious input to execute arbitrary SQL commands against the backend database. The fix, implemented in version 6.3.4, restricts raw attribute selects to prevent SQL injection (commit 0f2d85f). Mitigation involves upgrading to patched versions or implementing strict input validation at the application layer.

Affected products

Feathers feathers-sequelize 6.0.0 through 6.3.3

Identifiers

CVE-2022-2422
GHSA-qpv8-4pjq-qqh7

Timeline

2022-10-26: disclosed
2022-10-26: patched: Fixed in version 6.3.4

References

https://github.com/feathersjs-ecosystem/feathers-sequelize/commit/0f2d85f0b2d556f2b6c70423dcebdbd29d95e3dc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.