Executive brief
feathers-sequelize is a Node.js library that provides database access for Feathers applications using Sequelize ORM. Due to improper input validation, attackers can inject arbitrary SQL commands into database queries, potentially reading, modifying, or deleting sensitive data. This vulnerability affects web applications that use the vulnerable library versions to handle untrusted user input.
Technical details
The vulnerability stems from CWE-89 (SQL Injection) caused by improper input validation in feathers-sequelize versions 6.0.0 through 6.3.3. The flaw allows attackers to inject raw SQL through attribute selection parameters in database queries without proper sanitization. An unauthenticated attacker over the network can craft malicious input to execute arbitrary SQL commands against the backend database. The fix, implemented in version 6.3.4, restricts raw attribute selects to prevent SQL injection (commit 0f2d85f). Mitigation involves upgrading to patched versions or implementing strict input validation at the application layer.
Affected products
- Feathers feathers-sequelize 6.0.0 through 6.3.3
Timeline
- 2022-10-26: disclosed
- 2022-10-26: patched: Fixed in version 6.3.4