CVE-2023-25813: Sequelize SQL injection via replacements

CVE-2023-25813 · Severity: low · CVSS 3.1 · Published 2023-02-22

Sequelize is a popular Node.js ORM library used to interact with databases. A vulnerability in how it handles SQL query parameters allows attackers to inject arbitrary SQL commands when using the replacements feature alongside the where option, potentially leading to unauthorized data access, modification, or deletion. Applications using affected versions of Sequelize are at risk of complete database compromise if they combine these query construction methods.

Technologies: sequelize (npm). Vendors: npm.

Quick answers

Is CVE-2023-25813 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-25813 being exploited in the wild.
How severe is CVE-2023-25813?
Low severity, with a CVSS score of 3.1, published 22 February 2023.
Which products and versions are affected?
sequelize (npm) SEMVER:introduced=0,fixed=6.19.1.
Is there a fix for CVE-2023-25813?
Yes. sequelize (npm): upgrade to 6.19.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-25813 attacked?
It is attacked over the network.
Am I affected by CVE-2023-25813?
Check whether you run sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • sequelize (npm): upgrade to 6.19.1 or later
    npm install sequelize@6.19.1

Technical details

The vulnerability is a SQL injection (CWE-89) in Sequelize's query parameter handling. When a query combines the where option with replacements, Sequelize first constructs SQL from the where clause, then performs string-based replacement of :parameter placeholders. An attacker can exploit this by injecting replacement parameter values into fields that get inserted into the literal where clause, causing those values to be interpreted as SQL rather than data. This affects versions prior to 6.19.2 when using both replacements and where in the same query. No authentication is required and the vulnerability is network-accessible for any application accepting user input and passing it through Sequelize queries. The fix is available in version 6.19.2 and later.

Affected products

  • Sequelize Sequelize < 6.19.2

Identifiers

  • CVE-2023-25813
  • GHSA-wrh9-cjv3-2hpw

Timeline

  • 2023-02-22: disclosed: GHSA-wrh9-cjv3-2hpw published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.