CVE-2024-42005: Django JSONField SQL Injection
Summary
CVE-2024-42005: An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. Affects django across 2 version ranges.
>= 4.2.0, < 4.2.15
>= 5.0.0, < 5.0.8
Fixed in 4.2.15 or 5.0.8, depending on the release line you run. How to fix ↓
Also tracked for
- django · PyPI
- python-django · Debian:11
- django · PyPI
The same CVE-2024-42005 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular web framework written in Python that enables developers to build web applications quickly and efficiently. It provides a wide range of features and tools for handling various aspects of web development. One of its features is the JSONField, which allows storing JSON data in a database. However, versions of Django prior to 5.0.8 and 4.2.15 are vulnerable to a SQL injection issue when using the QuerySet.values() and values_list() methods on models with a JSONField. This vulnerability can be exploited by passing a crafted JSON object key as an argument, leading to potential SQL injection in column aliases.
Vulnerability Detail
The vulnerability in Django arises due to insufficient input validation when using the values() and values_list() methods on models with a JSONField. An attacker can exploit this vulnerability by providing a specially crafted JSON object key as an argument. This can result in SQL injection in column aliases, potentially leading to unauthorized access, data leakage, or other malicious activities. The severity of this vulnerability is rated as Critical.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.2.0, < 4.2.154.2.15 -
>= 5.0.0, < 5.0.85.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can manually sanitize and validate the input before passing it to the values() and values_list() methods. This can be achieved by implementing proper input validation and sanitization techniques, such as using parameterized queries or escaping special characters. Here is an example of how to sanitize the input using the Django ORM:
# Sanitize and validate input
key = sanitize_input(request.GET.get('key'))
# Perform query with sanitized input
results = MyModel.objects.values(key)
Conclusion
The SQL injection vulnerability in Django versions prior to 5.0.8 and 4.2.15 can be exploited by passing a crafted JSON object key as an argument to the values() and values_list() methods on models with a JSONField. Upgrading to the patched versions and implementing proper input validation are necessary steps to mitigate the risk of this vulnerability.
See every vulnerability recorded for django →
FAQ
Django is a web framework written in Python that simplifies the process of building web applications. It provides a range of tools and features for handling various aspects of web development.
A JSONField in Django allows storing JSON data in a database. It provides a convenient way to work with JSON objects and their properties.
The SQL injection vulnerability in Django occurs when using the values() and values_list() methods on models with a JSONField. Insufficient input validation allows an attacker to inject malicious SQL code through a crafted JSON object key.
This vulnerability can lead to unauthorized access, data leakage, or other malicious activities. An attacker could manipulate the SQL queries and potentially retrieve sensitive information or modify the database contents.
To protect your Django application, it is crucial to upgrade to the patched versions (5.0.8 or 4.2.15) of Django. Additionally, implementing proper input validation and sanitization techniques is essential to prevent SQL injection attacks.
Related vulnerabilities
Recent vulnerabilities recorded for django.
