SB2023022440 - Improper Filtering of Special Elements in Sequelize

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Filtering of Special Elements (CVE-ID: CVE-2023-22578)

CWE-ID: CWE-790 - Improper Filtering of Special Elements

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to execute arbitrary SQL.

The vulnerability exists due to improper filtering of special elements in the attributes option when processing attribute names containing parentheses. A remote attacker can supply a specially crafted attribute value to execute arbitrary SQL.

The issue occurs because attribute strings containing parentheses are used as-is in generated SQL by default.

Remediation

Install update from vendor's website.

References

• https://github.com/sequelize/sequelize/security/advisories/GHSA-f598-mfpv-gmfx
• https://github.com/advisories/GHSA-f598-mfpv-gmfx