Sequalize - Default support for “raw attributes” when using parentheses

Vulnerability

Details CVE-2023-22578 is a SQL injection vulnerability in Sequelize, a popular Node.js ORM. The bug stems from improper attribute filtering in the library's query generation, specifically insufficient escaping of string attributes. This allows an attacker to inject malicious SQL fragments through user-controllable inputs [1]. The vulnerability was addressed by a fix that ensures string attributes are always escaped [1].

Exploitation

An attacker can exploit this vulnerability by providing crafted input that is used in Sequelize queries without proper sanitization. No authentication is required if the application exposes vulnerable endpoints to unauthenticated users. The attack vector is network-based, and the complexity is low [3].

Impact

Successful exploitation could allow an attacker to execute arbitrary SQL commands against the underlying database, leading to data theft, modification, or deletion, and potentially full compromise of the database server [3].

Mitigation

The vulnerability is patched in Sequelize v6.29.0 and v7.0.0-alpha.20 [1][2]. Users are advised to upgrade to these or later versions. For more details, refer to the official GitHub repository [4] and the NVD entry [3].