CVE-2022-34265: Django Trunc() and Extract() SQL Injection Vulnerability
Summary
CVE-2022-34265: An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. Affects django across 2 version ranges.
>= 3.2.0, < 3.2.14
>= 4.0.0, < 4.0.6
Fixed in 3.2.14 or 4.0.6, depending on the release line you run. How to fix ↓
Also tracked for
- django · PyPI
- python-django · Debian:11
- django · PyPI
The same CVE-2022-34265 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular open-source web framework written in Python. It provides a set of tools and libraries for building web applications quickly and efficiently. The Trunc() and Extract() database functions in Django allow users to manipulate and extract data from database fields. However, versions of Django prior to 3.2.14 and 4.0.6 are vulnerable to SQL injection if untrusted data is used as a kind/lookup_name value. This means that an attacker could potentially execute arbitrary SQL queries, leading to unauthorized access, data leakage, or other malicious activities.
Vulnerability Detail
The SQL injection vulnerability in Django's Trunc() and Extract() functions arises when untrusted data is used as a kind/lookup_name value. If an application does not properly validate and sanitize user input before using it in these functions, an attacker can craft a malicious input that includes SQL statements. When the vulnerable code executes, the SQL statements are executed as well, allowing the attacker to manipulate the database or retrieve sensitive information. Applications that restrict the kind/lookup_name value to a known safe list are not affected by this vulnerability.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.2.0, < 3.2.143.2.14 -
>= 4.0.0, < 4.0.64.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround is to carefully validate and sanitize user input before using it as a kind/lookup_name value in the Trunc() and Extract() functions. This can be achieved by implementing input validation and sanitization routines, such as using parameterized queries or prepared statements, to prevent the execution of arbitrary SQL statements.
Conclusion
The SQL injection vulnerability in Django's Trunc() and Extract() functions can have severe consequences if left unaddressed. It is recommended to upgrade Django to version 3.2.14 or 4.0.6, or any subsequent secure versions, to mitigate the risk. If immediate upgrading is not possible, implementing proper input validation and sanitization routines can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The SQL injection vulnerability in Django's Trunc() and Extract() functions can lead to unauthorized access, data leakage, or other malicious activities. An attacker could execute arbitrary SQL queries, potentially compromising the integrity and confidentiality of the application's database.
No, only versions prior to 3.2.14 and 4.0.6 are vulnerable. It is recommended to upgrade to the latest secure version to mitigate the risk.
At the time of this report, there is no known public exploit for this vulnerability. However, it is essential to address the vulnerability promptly to prevent potential exploitation.
Yes, this vulnerability can be exploited remotely if the affected Django application is accessible over the network. Attackers can send crafted requests containing malicious input to exploit the SQL injection vulnerability.
There is no evidence of active exploitation of this vulnerability at the time of this report. However, it is crucial to apply the necessary security patches or upgrades to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for django.
