CVE-2016-10554

Vulnerability

Sequelize, an Object-Relational Mapping (ORM) for Node.js, incorrectly defaulted SQLite to use MySQL backslash escaping instead of the proper PostgreSQL-style escaping before version 1.7.0-alpha3 [1]. This affects all sequelize versions <= 1.7.0-alpha2 when using SQLite as the database dialect [2]. The bug resides in the SqlString.escape function, which only applied PostgreSQL escaping for the postgres dialect, leaving SQLite to use the less restrictive MySQL escape logic [3].

Exploitation

An attacker can exploit this by providing crafted input that is used in SQL queries through sequelize. Since SQLite uses single-quote escaping (doubling single quotes) in PostgreSQL style, but sequelize applied MySQL backslash escaping, an attacker could inject a single quote (') that would not be properly escaped, allowing manipulation of the SQL query structure. No special network position is required if the application accepts user input and passes it through sequelize to a SQLite database [1][3].

Impact

Successful exploitation allows SQL injection, potentially leading to unauthorized reading, modification, or deletion of database contents. While SQLite is often used for testing or lightweight deployments, a full data compromise or denial of service is possible depending on the application's use of the affected sequelize version [1][2][3].

Mitigation

Upgrade to sequelize version 1.7.0-alpha3 or later, which fixes the issue by adding the sqlite dialect check in the escape function [3]. The fix was committed on an unspecified date and is included in the 1.7.0-alpha3 release. There is no known workaround; updating the library is the recommended mitigation [1][2].