SQL injection from AWS Lambda event data in Sequelize raw query

Critical Risk sql-injection
javascriptnodejsaws-lambdasequelizesql-injectionorm

What it is

SQL injection vulnerability where untrusted event fields are concatenated into SQL passed to sequelize.query without parameterization or proper binding, potentially allowing attackers to read or modify database data, escalate privileges, or run arbitrary queries via crafted Lambda event input.

ℹī¸ Configuration Fix

Configuration changes required - see explanation below.

💡 Explanation

ℹī¸ Configuration Fix

Configuration changes required - see explanation below.

💡 Explanation

Why it happens

Event fields are directly concatenated into SQL strings passed to sequelize.query() without replacements.

Root causes

String Concatenation in Raw Queries

Event fields are directly concatenated into SQL strings passed to sequelize.query() without replacements.

Missing Parameter Replacements

Failing to use Sequelize's replacements or bind parameters for user-controlled data.

Fixes

1

Use Parameterized Queries with Replacements

Always use replacements or bind parameters when executing raw SQL with Sequelize.

View implementation 
sequelize.query('SELECT * FROM users WHERE id = ?', { replacements: [id], type: QueryTypes.SELECT })
2

Prefer Model Methods Over Raw SQL

Use Sequelize model methods with where options instead of raw SQL whenever possible.

View implementation 
User.findAll({ where: { id: userId } }) instead of raw SQL queries
3

Validate Event Input

Implement strict validation for all Lambda event fields before using them in queries.

View implementation 
Validate that IDs are numbers, strings match expected patterns, etc.

Detect This Vulnerability in Your Code

Sourcery automatically identifies sql injection from aws lambda event data in sequelize raw query and many other security issues in your codebase.

Scan Your Code for Free Explore More Vulnerabilities