Executive brief
Sequelize, a popular ORM (Object-Relational Mapping) library for Node.js, contains an unsafe parameter handling flaw in its query condition filtering. An attacker with access to application logic could craft malicious input to inject unfiltered database queries, potentially allowing unauthorized data access or modification.
Technical details
The vulnerability is a result of improper parameter filtering in Sequelize's getWhereConditions function, leading to an unsafe fall-through condition (CWE-843). This allows database injection attacks when user-controlled input is not properly sanitized before being used in query construction. Exploitation requires application context where user input flows into Sequelize query builders without adequate validation. The vulnerability affects all versions prior to 7.0.0-alpha.20 of @sequelize/core. An attacker can bypass filtering mechanisms to inject arbitrary database commands, potentially achieving unauthorized data exfiltration or modification.
Affected products
- Sequelize @sequelize/core <7.0.0-alpha.20
Timeline
- 2023-02-16: disclosed
- 2023-02-23: patched: Advisory withdrawn as duplicate of GHSA-vqfx-gj96-3w95; fix released in 7.0.0-alpha.20