Executive brief
feathers-sequelize is a database adapter for the Feathers.js web framework that bridges applications to multiple SQL databases. An improper parameter validation flaw allows unauthenticated attackers to inject arbitrary SQL commands, potentially exposing or modifying sensitive database records. This vulnerability affects applications using vulnerable versions without authentication requirements.
Technical details
feathers-sequelize versions 6.0.0 through 6.3.3 fail to properly validate user-supplied attribute parameters, allowing SQL injection via raw attribute selections. The vulnerability stems from the library's handling of database query parameters without adequate sanitization or parameterization. An unauthenticated attacker with network access to an affected application can craft malicious requests to inject SQL statements directly into database queries. The attack requires no authentication or user interaction. Successful exploitation allows reading, modifying, or deleting arbitrary database records. The fix, released in version 6.3.4, adds strict validation to disallow raw attribute selections in query parameters.
Affected products
- feathersjs-ecosystem feathers-sequelize 6.0.0 through 6.3.3
Timeline
- 2022-10-26: disclosed: Limited public disclosure via GitHub advisory
- 2022-10-31: patched: Fix released in version 6.3.4
References
- https://github.com/feathersjs-ecosystem/feathers-sequelize/commit/0f2d85f0b2d556f2b6c70423dcebdbd29d95e3dc
- https://csirt.divd.nl/CVE-2022-29822
- https://csirt.divd.nl/DIVD-2022-00020
- https://csirt.divd.nl/cases/DIVD-2022-00020
- https://csirt.divd.nl/cves/CVE-2022-29822
- https://github.com/feathersjs-ecosystem/feathers-sequelize