PT-2019-6147 · Sequelize · Sequelize

Published 2019-08-18 · Updated 2019-10-25 · CVE-2019-10752

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sequelize versions prior to 4.44.3 and 5.15.1

Description The issue is related to the sequelize.json() helper function not properly escaping values when formatting sub paths for JSON queries for MySQL, MariaDB, and SQLite, leading to SQL Injection. This allows attackers to inject SQL statements and execute arbitrary SQL queries if user input is passed to the query. The vulnerability may impact the confidentiality, integrity, and availability of protected information.

Recommendations If you are using Sequelize 5.x, upgrade to version 5.15.1 or later. If you are using Sequelize 4.x, upgrade to version 4.44.3 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2022-00005

CVE-2019-10752

GHSA-M9JW-237R-GVFV

SNYK-JS-SEQUELIZE-459751

SNYK-JS-SEQUELIZE-459751

Affected Products

Sequelize

References · 13

• 🔥 https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751 · Exploit
• https://github.com/sequelize/sequelize/commit/9bd0bc111b6f502223edf7e902680f7cc2ed541e · Patch
• https://osv.dev/vulnerability/CVE-2019-10752 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10752 · Security Note
• https://osv.dev/vulnerability/GHSA-m9jw-237r-gvfv · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00005 · Security Note
• https://github.com/sequelize/sequelize/commit/9bd0bc1%2C · Note
• https://github.com/sequelize/sequelize/pull/11329 · Note
• https://github.com/sequelize/sequelize/commit/9bd0bc1, · Note
• https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751%2C · Note
• https://npmjs.com/advisories/1146 · Note
• https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751, · Note
• https://security.snyk.io/vuln/SNYK-JS-SEQUELIZE-459751 · Note