Executive brief
Sequelize is a popular ORM (object-relational mapping) library for Node.js that allows developers to interact with databases using JavaScript. Versions before 4.12.0 fail to properly sanitize query operators like $gt, allowing attackers to inject malicious NoSQL commands that can alter data queries, modify data, or potentially gain unauthorized access to the database.
Technical details
Sequelize prior to version 4.12.0 is vulnerable to NoSQL Injection due to improper sanitization of query operators such as $gt. The vulnerability exists because query operators are not properly validated before being passed to the database engine, allowing an attacker to inject NoSQL operators into queries through application input. An attacker can craft special input that bypasses query filters and alters the intended database operation, leading to unauthorized data access or modification. The fix was implemented in version 4.12.0 and merged in pull request #8240, which adds proper operator sanitization.
Affected products
- Sequelize Sequelize before 4.12.0
Timeline
- 2019-06-04: disclosed
- 2017-09-30: patched: Fix merged in PR #8240