Executive brief
Sequelize is a popular Node.js ORM library used to interact with databases in web applications. A vulnerability in input filtering allows attackers to craft malicious queries that expose sensitive database information without requiring authentication or user interaction. This could lead to unauthorized data leakage affecting customer privacy and application security.
Technical details
The vulnerability stems from improper input filtering in Sequelize's query handling mechanism, specifically in the `where` clause processing (CWE-200: Information Exposure). Attackers can supply specially crafted query parameters to bypass intended filters and access sensitive database records. The attack requires network access to the application but no authentication; it can be triggered through standard application queries. The vulnerability was fixed in Sequelize v6.28.1 and v7.0.0-alpha.20, with patches implemented in pull requests #15375 and #15699 that enforce stricter validation on `where` clause values.
Affected products
- Sequelize sequelize All versions before 6.28.1
- Sequelize @sequelize/core All versions before 7.0.0-alpha.20
Timeline
- 2023-02-16: disclosed
- 2023-02-16: patched: Fixes released in v6.28.1 and v7.0.0-alpha.20