CVE-2019-10752: SQL Injection
Affected versions of sequelize are vulnerable to SQL Injection. The function sequelize.json() incorrectly formatted sub paths for JSON queries, which allows attackers to inject SQL statements and execute arbitrary SQL queries if user input is passed to the query. Exploitation example:
js return User.findAll({ where: this.sequelize.json("data.id')) AS DECIMAL) = 1 DELETE YOLO INJECTIONS; -- ", 1) });
Recommendation
If you are using sequelize 5.x, upgrade to version 5.15.1 or later. If you are using sequelize 4.x, upgrade to version 4.44.3 or later.
Other sources
Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-10752?
CVE-2019-10752 is a vulnerability in the Sequelize library which allows SQL Injection attacks.
What is the severity of CVE-2019-10752?
CVE-2019-10752 has a severity rating of 9.8 (Critical).
How does CVE-2019-10752 work?
CVE-2019-10752 allows attackers to inject SQL statements and execute arbitrary SQL queries by incorrectly formatting sub paths for JSON queries in the Sequelize library.
Which versions of Sequelize are affected by CVE-2019-10752?
Sequelize versions prior to version 4.44.3 and 5.15.1 are affected by CVE-2019-10752.
How can I fix the CVE-2019-10752 vulnerability?
To fix the CVE-2019-10752 vulnerability, update to Sequelize version 4.44.3 or 5.15.1.