Sequelize Database Connection without TLS Enforcement

What it is

The Sequelize ORM configuration connects to databases without enforcing TLS encryption, potentially transmitting sensitive data over unencrypted connections. This vulnerability exposes database communications to eavesdropping and man-in-the-middle attacks.

// Vulnerable: Sequelize without TLS enforcement
const { Sequelize } = require('sequelize');

// Dangerous: No SSL/TLS configuration
const sequelize = new Sequelize('database', 'username', 'password', {
  host: 'db.example.com',
  port: 5432,
  dialect: 'postgres',
  // Missing SSL configuration
  logging: false
});

// Test connection without encryption
sequelize.authenticate()
  .then(() => console.log('Connected to database'))
  .catch(err => console.error('Connection failed:', err));

// Secure: Sequelize with TLS enforcement
const { Sequelize } = require('sequelize');
const fs = require('fs');

// Load SSL certificates if needed
const sslConfig = {
  require: true,
  rejectUnauthorized: true
};

// For custom CA certificates
if (process.env.DB_CA_CERT_PATH) {
  sslConfig.ca = fs.readFileSync(process.env.DB_CA_CERT_PATH);
}

// Secure: SSL/TLS enforced connection
const sequelize = new Sequelize(
  process.env.DB_NAME,
  process.env.DB_USER,
  process.env.DB_PASSWORD,
  {
    host: process.env.DB_HOST,
    port: process.env.DB_PORT || 5432,
    dialect: 'postgres',
    dialectOptions: {
      ssl: sslConfig
    },
    pool: {
      max: 10,
      min: 0,
      acquire: 30000,
      idle: 10000
    },
    logging: process.env.NODE_ENV === 'development' ? console.log : false
  }
);

// Test secure connection
sequelize.authenticate()
  .then(() => console.log('Securely connected to database'))
  .catch(err => console.error('Secure connection failed:', err));

Why it happens

Node.js applications using Sequelize ORM connect to databases without explicit SSL/TLS configuration. By default, Sequelize constructors like new Sequelize(database, username, password, { host, dialect }) do not enforce encrypted connections unless explicitly configured through dialectOptions.ssl. When developers initialize Sequelize with basic options containing only host, port, and dialect properties, the ORM establishes unencrypted TCP connections to database servers. All database queries, authentication credentials, and result sets containing sensitive data (user records, financial transactions, personal information) transmit in plaintext across network infrastructure. Attackers positioned on the network path between application servers and database servers can passively capture network traffic using tools like tcpdump or Wireshark to extract SQL queries revealing schema information, authentication tokens in WHERE clauses, and complete record sets in SELECT results.

Fixes

Related Vulnerabilities