CVE-2024-5753: SQL Injection Vulnerability in vanna
Summary
CVE-2024-5753: Vanna vulnerable to SQL Injection. Affects vanna versions < 0.3.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vanna is a Python package available on PyPI that provides various functionalities for AI applications. It includes critical file-handling functions like pg_read_file(). This vulnerability affects vanna version v0.3.4. The vulnerability allows unauthenticated remote users to exploit exposed SQL queries via a Python Flask API, leading to SQL injection. This can result in the unauthorized reading of arbitrary local files on the victim server, including sensitive files like /etc/passwd.
Vulnerability Detail
The SQL injection vulnerability in vanna version v0.3.4 allows remote attackers to execute arbitrary SQL commands through the exposed SQL queries. By manipulating the input parameters, an attacker can inject malicious SQL code, which can lead to unauthorized access to sensitive files on the victim server. This vulnerability has a CVSSv3 score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement input validation and sanitization techniques to mitigate the risk of SQL injection attacks. By validating and sanitizing user input, the chances of successful exploitation can be reduced. Here is an example of input validation using Python Flask:
from flask import request
from werkzeug.exceptions import BadRequest
@app.route('/endpoint', methods=['POST'])
def endpoint():
input_param = request.form.get('input_param')
if not input_param:
raise BadRequest('Input parameter is required.')
# Perform further processing
This code snippet demonstrates how to validate and ensure the input_param is not empty before further processing.
Conclusion
The SQL injection vulnerability in vanna version v0.3.4 exposes critical file-handling functions to potential exploitation. Unauthenticated remote attackers can read arbitrary local files on the victim server, including sensitive files. It is crucial to update to a patched version of vanna and implement input validation to mitigate the risk of SQL injection attacks.
See every vulnerability recorded for vanna →
FAQ
The vulnerability allows unauthenticated remote attackers to read arbitrary local files on the victim server, including sensitive files. This can lead to unauthorized access to sensitive information and potential further exploitation.
No, authentication is not required. Unauthenticated remote users can exploit the vulnerability by manipulating the input parameters and injecting malicious SQL code.
The vulnerability affects vanna version v0.3.4. Earlier versions may also be affected, but the exact range of affected versions is not specified.
Yes, the maintainers of vanna have released a fix for this vulnerability in a later version. Users are advised to update their vanna package to a version beyond v0.3.4 to mitigate the risk.
The CVSSv3 score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for vanna.
