Executive brief
Sequelize is a popular Node.js ORM library used to interact with databases. A vulnerability in how it handles SQL query parameters allows attackers to inject arbitrary SQL commands when using the replacements feature alongside the where option, potentially leading to unauthorized data access, modification, or deletion. Applications using affected versions of Sequelize are at risk of complete database compromise if they combine these query construction methods.
Technical details
The vulnerability is a SQL injection (CWE-89) in Sequelize's query parameter handling. When a query combines the where option with replacements, Sequelize first constructs SQL from the where clause, then performs string-based replacement of :parameter placeholders. An attacker can exploit this by injecting replacement parameter values into fields that get inserted into the literal where clause, causing those values to be interpreted as SQL rather than data. This affects versions prior to 6.19.2 when using both replacements and where in the same query. No authentication is required and the vulnerability is network-accessible for any application accepting user input and passing it through Sequelize queries. The fix is available in version 6.19.2 and later.
Affected products
- Sequelize Sequelize < 6.19.2
Timeline
- 2023-02-22: disclosed: GHSA-wrh9-cjv3-2hpw published