CVE-2016-10553

Vulnerability

Sequelize versions 2.1.3 and earlier are vulnerable to SQL injection [1][2]. The library, an Object-Relational Mapping (ORM) for Node.js supporting multiple database backends (Postgres, MySQL, MariaDB, SQLite, Microsoft SQL Server), did not properly sanitize certain user-supplied inputs before constructing SQL queries. This allows an attacker to inject malicious SQL fragments through parameters that are concatenated into query strings rather than passed as bound parameters.

Exploitation

The attacker requires the ability to supply untrusted input that reaches a vulnerable query construction path in Sequelize. No authentication or special network position is described in the references. The exploitation involves crafting input strings containing SQL metacharacters or statements that, when passed through the vulnerable ORM methods, become part of the final SQL statement sent to the database [1].

Impact

Successful exploitation leads to arbitrary SQL execution against the database. This can result in data theft (confidentiality breach), data modification (integrity loss), or potentially denial of service. The attacker can read, modify, or delete records depending on database permissions, possibly achieving full compromise of the database content accessible to the application's database user [1][2].

Mitigation

A fix was released in Sequelize 2.1.4 [1][2]. All users should upgrade to version 2.1.4 or later. There are no known workarounds described in the references; applying the patch is the recommended mitigation.