Critical SQL Injection Vulnerability in Django Package: py-django and py3-django
Summary
ALPINE-CVE-2020-7471: Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows w... Affects py-django versions < 1.11.28-r0. Fixed in 1.11.28-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and comes with a plethora of features, including an ORM, authentication, and an admin interface. However, certain versions of Django are vulnerable to SQL injection attacks when untrusted data is used as a StringAgg delimiter, potentially compromising the integrity of the database and the application.
Vulnerability Detail
The vulnerability, identified as CVE-2020-7471, affects Django versions prior to 1.11.28, 2.2 prior to 2.2.10, and 3.0 prior to 3.0.3. It allows attackers to exploit the StringAgg function in PostgreSQL by injecting malicious SQL through a crafted delimiter. This can lead to unauthorized data access, data manipulation, or even complete database compromise, making it a critical security issue with a CVSS score of 9.8.
How To Fix
Minimum fixed version
1.11.28-r0
This is the first release that contains the fix.
sudo apk add --upgrade py-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using untrusted data as a delimiter in StringAgg functions until the package is updated. Validate and sanitize any user inputs that may be used in SQL queries to mitigate the risk of SQL injection.
Conclusion
The SQL injection vulnerability in Django's StringAgg function poses a significant risk to applications using affected versions of the py-django and py3-django packages. It is crucial to update to the patched versions to ensure the security of your application. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for py-django →
FAQ
CVE-2020-7471 is a critical SQL injection vulnerability found in certain versions of Django that allows attackers to inject malicious SQL through untrusted data used as a StringAgg delimiter.
Django versions before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
If immediate updates are not possible, ensure to validate and sanitize any user inputs that may be used in SQL queries to mitigate the risk of SQL injection.
References
Related vulnerabilities
Recent vulnerabilities recorded for py-django.
