Описание
SQL Injection in sequelize
Affected versions of sequelize are vulnerable to SQL Injection. The function sequelize.json() incorrectly formatted sub paths for JSON queries, which allows attackers to inject SQL statements and execute arbitrary SQL queries if user input is passed to the query. Exploitation example:
Recommendation
If you are using sequelize 5.x, upgrade to version 5.15.1 or later.
If you are using sequelize 4.x, upgrade to version 4.44.3 or later.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2019-10752
- https://github.com/sequelize/sequelize/pull/11329
- https://github.com/sequelize/sequelize/commit/9bd0bc1,
- https://github.com/sequelize/sequelize/commit/9bd0bc111b6f502223edf7e902680f7cc2ed541e
- https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751
- https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751,
- https://www.npmjs.com/advisories/1146
Пакеты
sequelize
< 4.44.3
4.44.3
sequelize
>= 5.0.0, < 5.15.1
5.15.1
Связанные уязвимости
Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.
Уязвимость sequelize.json() ORM-библиотеки для приложений Sequelize, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации