Junglewise Threat Intelligence

CVE-2022-29822: feathers-sequelize SQL injection in attribute filtering

CVE-2022-29822 · Severity: low · CVSS 3.1 · Published 2022-10-26

Technologies: feathers-sequelize (npm). Vendors: npm.

Executive brief

feathers-sequelize is a database adapter for the Feathers.js web framework that bridges applications to multiple SQL databases. An improper parameter validation flaw allows unauthenticated attackers to inject arbitrary SQL commands, potentially exposing or modifying sensitive database records. This vulnerability affects applications using vulnerable versions without authentication requirements.

Technical details

feathers-sequelize versions 6.0.0 through 6.3.3 fail to properly validate user-supplied attribute parameters, allowing SQL injection via raw attribute selections. The vulnerability stems from the library's handling of database query parameters without adequate sanitization or parameterization. An unauthenticated attacker with network access to an affected application can craft malicious requests to inject SQL statements directly into database queries. The attack requires no authentication or user interaction. Successful exploitation allows reading, modifying, or deleting arbitrary database records. The fix, released in version 6.3.4, adds strict validation to disallow raw attribute selections in query parameters.

Affected products

  • feathersjs-ecosystem feathers-sequelize 6.0.0 through 6.3.3

Timeline

  • 2022-10-26: disclosed: Limited public disclosure via GitHub advisory
  • 2022-10-31: patched: Fix released in version 6.3.4

References

Related threats