CVE-2023-22578 Sequalize - Default support for “raw attributes” when using parentheses
Attackers can perform SQL injection attacks via improper attribute filtering in the Sequelize.js library, potentially accessing or modifying database contents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-22578?
CVE-2023-22578 is a critical SQL injection vulnerability in Feathers-Sequalize Sequelize.js, published on 16 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections.
Weakness: CWE-790
Which versions are affected by CVE-2023-22578?
4 open source packages ship an affected version, including @sequelize/core and sequelize. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@sequelize/core npm | All versions | 7.0.0-alpha.20 |
@sequelize/core npm | All versions | 7.0.0-alpha.20 |
sequelize npm | All versions | 6.29.0 |
sequelize npm | All versions | 6.29.0 |
Products include Sequelizejs Sequelize.
How do I fix CVE-2023-22578?
Upgrade @sequelize/core to 7.0.0-alpha.20 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2023-22578 being exploited?
There is no known exploitation of CVE-2023-22578 in the wild and no public exploit code.
Other vulnerabilities in Feathers-Sequalize Sequelize.js
Sources
Also known as GHSA-f598-mfpv-gmfx.