Executive brief
Sequelize is an Object-Relational Mapping (ORM) library used to interact with databases in Node.js applications. A vulnerability allows developers to accidentally enable SQL injection when building database queries with user-provided attribute names containing parentheses. An attacker could exploit this to read, modify, or delete database records if an application passes untrusted input directly to Sequelize's attribute option.
Technical details
This vulnerability exists in Sequelize's handling of attribute specifications when using the tuple syntax (e.g., ['count(id)', 'count']). Prior to the patch, Sequelize would treat strings containing parentheses as "raw" SQL expressions and inject them directly into the query without escaping, enabling SQL injection. The vulnerability affects all versions of Sequelize 6 prior to 6.29.0 and all versions of @sequelize/core prior to 7.0.0-alpha.20. Exploitation requires the application to pass user-controlled input or insufficiently validated data into the attributes parameter of find operations. The attack vector is network-based with no authentication or user interaction required. The patch either escapes all attribute strings (Sequelize 7) or requires explicit opt-in to the unsafe behavior with a breaking change (Sequelize 6.29.0).
Affected products
- Sequelize sequelize < 6.29.0
- Sequelize @sequelize/core < 7.0.0-alpha.20
Timeline
- 2023-02-24: disclosed: Security advisory published
- 2023-02-24: patched: Sequelize 6.29.0 and @sequelize/core 7.0.0-alpha.20 released