Executive brief
Sequelize is a popular Object-Relational Mapping (ORM) library for Node.js that simplifies database interactions. An attacker can inject arbitrary SQL commands by supplying specially crafted input due to insufficient filtering of attributes, potentially allowing unauthorized data access, modification, or deletion. This vulnerability primarily affects applications that accept untrusted user input without proper validation.
Technical details
The vulnerability is classified as improper filtering of special elements (CWE-790) in the Sequelize ORM library. Inadequate attribute filtering allows attackers to construct SQL injection payloads that bypass input validation. The attack is network-accessible with no authentication or user interaction required. An attacker who can supply untrusted input to Sequelize database operations can execute arbitrary SQL commands with the privileges of the database connection, potentially leading to full compromise of data confidentiality, integrity, and availability. Patches are available in Sequelize 6.29.0 and @sequelize/core 7.0.0-alpha.20. Note: This advisory is marked as a duplicate of GHSA-f598-mfpv-gmfx.
Affected products
- Sequelize sequelize < 6.29.0
- Sequelize @sequelize/core < 7.0.0-alpha.20
Timeline
- 2023-02-16: disclosed: Advisory published
- 2023-02-24: other: Advisory withdrawn as duplicate