Is CVE-2023-22579 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-22579 being exploited in the wild.

How severe is CVE-2023-22579?

Low severity, with a CVSS score of 3.1, published 23 February 2023.

Which products and versions are affected?

@sequelize/core (npm) SEMVER:introduced=0,fixed=7.0.0-alpha.20; sequelize (npm) SEMVER:introduced=0,fixed=6.28.1.

Is there a fix for CVE-2023-22579?

Yes. @sequelize/core (npm): upgrade to 7.0.0-alpha.20 or later; sequelize (npm): upgrade to 6.28.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-22579 attacked?

It is attacked over the network.

Am I affected by CVE-2023-22579?

Check whether you run @sequelize/core (npm) or sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-22579: Sequelize unsafe fall-through in getWhereConditions

CVE-2023-22579 · Severity: low · CVSS 3.1 · Published 2023-02-23

Sequelize, a popular Node.js library for interacting with databases, contains a type-validation flaw that allows invalid query parameters to pass silently instead of being rejected. An attacker with database access could craft malicious queries that bypass input validation, potentially leading to unauthorized data access, modification, or system availability issues depending on how the application uses the library.

Technologies: @sequelize/core (npm), sequelize (npm). Vendors: npm.

Quick answers

Is CVE-2023-22579 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-22579 being exploited in the wild.
How severe is CVE-2023-22579?: Low severity, with a CVSS score of 3.1, published 23 February 2023.
Which products and versions are affected?: @sequelize/core (npm) SEMVER:introduced=0,fixed=7.0.0-alpha.20; sequelize (npm) SEMVER:introduced=0,fixed=6.28.1.
Is there a fix for CVE-2023-22579?: Yes. @sequelize/core (npm): upgrade to 7.0.0-alpha.20 or later; sequelize (npm): upgrade to 6.28.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-22579 attacked?: It is attacked over the network.
Am I affected by CVE-2023-22579?: Check whether you run @sequelize/core (npm) or sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@sequelize/core (npm): upgrade to 7.0.0-alpha.20 or later
```
npm install @sequelize/core@7.0.0-alpha.20
```
sequelize (npm): upgrade to 6.28.1 or later
```
npm install sequelize@6.28.1
```

Technical details

The vulnerability is a type-confusion issue (CWE-843) in the getWhereConditions function of Sequelize. When an invalid (non-object) value is passed to the `where` option of a query, the code fails to throw an error and instead silently ignores the invalid input. This occurs only at the top level of the where clause. An authenticated attacker can exploit this by providing type-mismatched values (e.g., a Date object where an object is expected) to manipulate query behavior. The patches are available in sequelize@6.28.1 and @sequelize/core@7.0.0-alpha.20.

Affected products

Sequelize sequelize before 6.28.1
Sequelize @sequelize/core before 7.0.0-alpha.20

Identifiers

CVE-2023-22579
GHSA-vqfx-gj96-3w95

Timeline

2023-02-23: disclosed: Vulnerability published in GHSA
2023-02-23: patched: Patches released: sequelize@6.28.1 and @sequelize/core@7.0.0-alpha.20

References

https://github.com/sequelize/sequelize/security/advisories/GHSA-vqfx-gj96-3w95

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.