SQL Injection Vulnerability in Django Package: CVE-2022-34265
Summary
CVE-2022-34265: An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. Affects python-django across 2 version ranges.
< 2:2.2.28-1~deb11u1
>= b6475d7d7940f3ce575e0b0f2d83e517f899b4cf, < 746e88cc634469112b823225c19d75c7362f8ecf
Fixed in 2:2.2.28-1~deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM (Object-Relational Mapping) system that allows developers to interact with databases using Python code. However, certain database functions, specifically Trunc() and Extract(), are vulnerable to SQL injection when untrusted data is used as input, potentially compromising the security of applications that rely on these functions.
Vulnerability Detail
CVE-2022-34265 is a critical SQL injection vulnerability found in Django versions 3.2 before 3.2.14 and 4.0 before 4.0.6. The vulnerability arises when untrusted data is passed as a kind or lookup_name value to the Trunc() and Extract() database functions. If exploited, this could allow an attacker to execute arbitrary SQL commands, leading to unauthorized data access or manipulation. Applications that restrict the input to a predefined safe list are not affected by this issue.
How To Fix
Minimum fixed version
2:2.2.28-1~deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing input validation to ensure that only safe values are passed to the Trunc() and Extract() functions. This can be done by creating a whitelist of acceptable values and checking user input against this list before processing it.
Conclusion
CVE-2022-34265 presents a significant risk to applications using vulnerable versions of Django. It is crucial to upgrade to the latest secure version to mitigate the risk of SQL injection attacks. Additionally, implementing input validation can serve as a temporary measure to protect against exploitation.
See every vulnerability recorded for python-django →
FAQ
CVE-2022-34265 is a SQL injection vulnerability in Django that affects certain database functions when untrusted data is used.
Django versions 3.2 before 3.2.14 and 4.0 before 4.0.6 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2022-34265 is 9.8, indicating a critical level of severity.
Implement input validation to restrict the values passed to the vulnerable functions as a temporary workaround until you can upgrade.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
