CVE-2019-11069: SQL Injection in sequelize
Summary
CVE-2019-11069: SQL Injection in sequelize. Affects sequelize versions >= 5.0.0, < 5.3.0. Fixed in 5.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sequelize is an Object-Relational Mapping (ORM) library for Node.js that provides easy access to databases by mapping database entries to objects. It is commonly used for interacting with relational databases such as PostgreSQL, MySQL, and SQLite. However, versions prior to 5.3.0 (excluding v3 and v4) of Sequelize are vulnerable to SQL Injection. This vulnerability arises from the improper handling of backslashes in string literals when the PostgreSQL option standard_conforming_strings is not set to on by default.
Vulnerability Detail
The SQL Injection vulnerability in Sequelize allows attackers to inject malicious SQL statements into the application's database queries. By exploiting this vulnerability, an attacker can manipulate the database queries and potentially gain unauthorized access to sensitive data, modify data, or perform other malicious actions. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
5.3.0
This is the first release that contains the fix.
npm install sequelize@5.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually set the standard_conforming_strings option to on in the PostgreSQL configuration. This can be done by modifying the PostgreSQL configuration file and adding the line standard_conforming_strings = on. However, it is strongly recommended to upgrade to the latest version of Sequelize as soon as possible.
Conclusion
In conclusion, the SQL Injection vulnerability in Sequelize (CVE-2019-11069) can be mitigated by upgrading to version 5.3.0 or later. It is crucial to promptly address this vulnerability to prevent potential unauthorized access and data manipulation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sequelize →
FAQ
Sequelize is an Object-Relational Mapping (ORM) library for Node.js that simplifies database access by mapping database entries to objects.
Versions prior to 5.3.0 (excluding v3 and v4) of Sequelize are vulnerable to this SQL Injection issue.
This vulnerability allows attackers to inject malicious SQL statements into the application's database queries, potentially leading to unauthorized access, data manipulation, or other malicious actions.
To fix this vulnerability, it is recommended to upgrade to version 5.3.0 or later of Sequelize.
A temporary workaround is to manually set the standard_conforming_strings option to on in the PostgreSQL configuration.
References
Related vulnerabilities
Recent vulnerabilities recorded for sequelize.
