Executive brief
Feather-Sequelize is a database integration library for the Feathers.js application framework. A flaw in its query filtering allows attackers to inject malicious code that executes with the privileges of the running application, potentially compromising database access and application logic.
Technical details
The cleanQuery method in Feather-Sequelize uses insecure recursive logic to filter unsupported keys from query objects, enabling prototype pollution attacks (CWE-1321). An attacker can craft malicious query objects that pollute the prototype chain of JavaScript objects, leading to Remote Code Execution (RCE) with application privileges. The attack requires network access to the application's query interface and no authentication or user interaction. The vulnerability affects versions 6.0.0 through 6.3.2 and was fixed in version 6.3.3.
Affected products
- Feather-Sequelize Feather-Sequelize 6.0.0 to 6.3.2
Timeline
- 2022-10-26: disclosed
- 2022-10-31: patched: Fixed in version 6.3.3