Junglewise Threat Intelligence

Sequelize NoSQL injection

Severity: info · Published 2019-06-04

Technologies: Sequelize. Vendors: npm.

Executive brief

Sequelize is a popular ORM (object-relational mapping) library for Node.js that allows developers to interact with databases using JavaScript. Versions before 4.12.0 fail to properly sanitize query operators like $gt, allowing attackers to inject malicious NoSQL commands that can alter data queries, modify data, or potentially gain unauthorized access to the database.

Technical details

Sequelize prior to version 4.12.0 is vulnerable to NoSQL Injection due to improper sanitization of query operators such as $gt. The vulnerability exists because query operators are not properly validated before being passed to the database engine, allowing an attacker to inject NoSQL operators into queries through application input. An attacker can craft special input that bypasses query filters and alters the intended database operation, leading to unauthorized data access or modification. The fix was implemented in version 4.12.0 and merged in pull request #8240, which adds proper operator sanitization.

Affected products

  • Sequelize Sequelize before 4.12.0

Timeline

  • 2019-06-04: disclosed
  • 2017-09-30: patched: Fix merged in PR #8240

References

Related threats