SQL Injection Vulnerability in Django Package: CVE-2022-28346
Summary
CVE-2022-28346: An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. Affects python-django across 2 version ranges.
< 2:2.2.28-1~deb11u1
>= 635d53a86a36cde7866b9caefeb64d809e6bfcd9, < 5c3300027b30c1b498d99010f7d618316f685045
Fixed in 2:2.2.28-1~deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM (Object-Relational Mapping) system that allows developers to interact with databases using Python code instead of SQL. However, certain methods within Django's ORM, specifically QuerySet.annotate(), aggregate(), and extra(), are vulnerable to SQL injection attacks when crafted dictionaries are passed as keyword arguments. This vulnerability affects multiple versions of Django, including 2.2, 3.2, and 4.0, prior to their respective patch releases.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the QuerySet methods, allowing attackers to inject malicious SQL code through crafted dictionaries. This can lead to unauthorized data access, data manipulation, or even complete database compromise. The issue is particularly concerning as it can be exploited without authentication, making it a critical security risk for applications using affected versions of Django. The CVSS score for this vulnerability is 9.8, indicating a high severity level.
How To Fix
Minimum fixed version
2:2.2.28-1~deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, consider implementing input validation and sanitization on user inputs that are passed to the QuerySet methods. This can help mitigate the risk of SQL injection until the package can be updated.
Conclusion
CVE-2022-28346 represents a significant security risk for applications using vulnerable versions of Django. It is crucial for developers to upgrade to the patched versions to protect their applications from potential SQL injection attacks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for python-django →
FAQ
CVE-2022-28346 is a vulnerability in Django that allows for SQL injection through improperly handled keyword arguments in certain QuerySet methods.
Django versions 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4 are affected by this vulnerability.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, data manipulation, and complete database compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2022-28346 is 9.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
