Denial of Service in sequelize
Summary
GHSA-fw4p-36j9-rrj3: Denial of Service in sequelize. Affects sequelize versions < 4.44.4. Fixed in 4.44.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sequelize is an Object-Relational Mapping (ORM) library for Node.js that provides easy access to databases by mapping database entries to objects. It is widely used in applications to interact with databases and perform CRUD operations. However, versions of sequelize prior to 4.44.4 are vulnerable to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability in sequelize lies in the SQLite dialect, where it fails to catch a TypeError exception for the results variable. This can be exploited by attackers to submit malicious input that triggers the exception and crashes the Node process. The issue occurs due to the undefined value of the results variable during a .map call. This vulnerability can have serious consequences as it allows an attacker to disrupt the availability of the affected Node application.
How To Fix
Minimum fixed version
4.44.4
This is the first release that contains the fix.
npm install sequelize@4.44.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented. One possible workaround is to add a try-catch block around the code that handles the results variable in the SQLite dialect. This will catch the TypeError exception and prevent the Node process from crashing. However, it is still strongly advised to upgrade to the fixed version as soon as possible.
Conclusion
The vulnerability in sequelize prior to version 4.44.4 can be exploited to cause a denial of service by crashing the Node process. To mitigate this vulnerability, it is crucial to upgrade to version 4.44.4 or later. If immediate upgrade is not possible, a temporary workaround can be implemented using a try-catch block. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sequelize →
FAQ
This vulnerability allows attackers to submit malicious input that crashes the Node process, leading to a denial of service. It can disrupt the availability of the affected application.
Versions prior to 4.44.4 are vulnerable to this DoS vulnerability.
Yes, a proof-of-concept code snippet is provided in the vulnerability details. It demonstrates how the Node process can be crashed by exploiting the issue.
A temporary workaround is to add a try-catch block around the code that handles the results variable in the SQLite dialect. However, upgrading to the fixed version is strongly recommended.
You can find more information about this vulnerability, including the source code and details, in the GitHub advisory database.
References
Related vulnerabilities
Recent vulnerabilities recorded for sequelize.
