Sequalize - Bad query filtering leading to SQL errors

Vulnerability

Overview The vulnerability CVE-2023-22580 is caused by improper input filtering in the Sequelize ORM library. Specifically, the library fails to properly sanitize inputs when handling escaped strings and WHERE clauses, leading to potential SQL injection-like behavior. This issue was identified and patched in subsequent releases [1][2].

Exploitation

An attacker can exploit this flaw by providing crafted input to application endpoints that use Sequelize for database queries. If the application does not properly validate user input before passing it to Sequelize functions, the attacker may be able to inject malicious SQL fragments. The exploitation does not necessarily require authentication, depending on the application's design [2][3].

Impact

Successful exploitation could allow an attacker to extract sensitive information from the database, such as user credentials, personal data, or other confidential records. The Dutch Institute for Vulnerability Disclosure (DIVD) has also published an advisory highlighting the potential for data disclosure [3].

Mitigation

The issue is resolved in Sequelize versions 6.28.1 (stable) and 7.0.0-alpha.20 (alpha). Users are strongly advised to upgrade to these patched versions or later. The fix addresses the improper input filtering and ensures that parameters are correctly escaped and validated [1][2][3].