Executive brief
Sequelize is a popular Node.js ORM (Object-Relational Mapping) library used to interact with databases. Versions before 4.44.4 contain a defect in the SQLite dialect that crashes the Node.js process when certain database operations are performed, allowing attackers to cause application downtime by submitting specially crafted input.
Technical details
The vulnerability is a Denial of Service caused by an unhandled TypeError exception in the SQLite dialect of Sequelize prior to version 4.44.4. The root cause is a missing error handler around a `.map()` call on the `results` variable, which may be undefined in certain conditions. An attacker can trigger this by submitting malicious input that causes the results variable to be undefined, leading to an uncaught exception that crashes the entire Node.js process. This is a network-reachable vulnerability if the application exposes database operations to untrusted input. The fix is available in version 4.44.4 and later.
Affected products
- Sequelize Sequelize < 4.44.4
Timeline
- 2020-09-03: disclosed
- 2020-02-21: patched: Fix merged in PR #11877