Executive brief
The Sequelize command-line tool, used for managing database migrations and models, contains a flaw that can expose database passwords in plain text. When the tool logs connection details, passwords containing certain special characters are not properly hidden. This could allow anyone with access to system logs or build output to see sensitive database credentials, potentially leading to unauthorized database access.
Technical details
The `filteredURL()` function in `src/helpers/config-helper.js` is responsible for masking sensitive information in connection strings before logging. It uses a regular expression to identify and replace the password; however, it fails to escape special characters within the `config.password` string before incorporating it into the regex pattern. If a password contains regex-significant characters, the matching logic fails, causing the password to be printed in plain text to the console or log files. This issue affects users providing database credentials via connection URLs. The vulnerability is resolved in version 5.5.0 by using `lodash.escapeRegExp` to sanitize the password input.
Affected products
- Sequelize sequelize-cli < 5.5.0
Timeline
- 2015-08-25: disclosed: Initial issue reported on GitHub
- 2018-12-04: other: Pull request submitted to fix the regex escaping issue
- 2019-05-05: patched: Fix merged into master branch
- 2019-06-05: advisory: GitHub Advisory published