CVE-2024-53908: Django SQL Injection Vulnerability in JSON Field Lookup
Summary
CVE-2024-53908: An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Affects django across 2 version ranges.
>= 4.2.0, < 4.2.17
>= 5.0.0, < 5.1.4
Fixed in 4.2.17 or 5.1.4, depending on the release line you run. How to fix ↓
Also tracked for
- django · PyPI
- django · PyPI
- python-django · Debian:12
The same CVE-2024-53908 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM (Object-Relational Mapping) system, which allows developers to interact with databases using Python code instead of SQL. However, certain versions of Django are vulnerable to SQL injection attacks when using the jsonfield.has_key lookup with untrusted data, particularly when connected to an Oracle database.
Vulnerability Detail
An issue was discovered in Django versions 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The vulnerability arises from the direct usage of the django.db.models.fields.json.HasKey lookup, which can be exploited if untrusted data is used as a left-hand side (lhs) value. This can lead to SQL injection attacks, allowing attackers to manipulate database queries and potentially gain unauthorized access to sensitive data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.2.0, < 4.2.174.2.17 -
>= 5.0.0, < 5.1.45.1.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you cannot update Django immediately, avoid using the jsonfield.has_key lookup with untrusted data as the lhs value. Instead, consider using alternative methods to achieve similar functionality without exposing your application to SQL injection risks.
Conclusion
In summary, CVE-2024-53908 is a critical SQL injection vulnerability affecting specific versions of Django when using the jsonfield.has_key lookup with untrusted data. It is essential to update to the patched versions to secure your application and prevent potential exploitation.
See every vulnerability recorded for django →
FAQ
CVE-2024-53908 is a vulnerability in Django that allows SQL injection through the jsonfield.has_key lookup when untrusted data is used.
Django versions 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, avoid using the jsonfield.has_key lookup with untrusted data to mitigate the risk of SQL injection.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data and manipulation of database queries, posing significant security risks.
Related vulnerabilities
Recent vulnerabilities recorded for django.
