SQL Injection Vulnerability in Django's QuerySet Methods
Summary
CVE-2024-42005: An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. Affects python-django versions >= 879e5d587b84e6fc961829611999431778eb9f6a, < 4d32ebcd57340aa8de2d6d31613f1646dc6391f6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust ORM (Object-Relational Mapping) system, which allows developers to interact with databases using Python objects instead of SQL queries. The framework includes various features such as authentication, URL routing, and templating. However, certain versions of Django are vulnerable to SQL injection attacks through the QuerySet.values() and values_list() methods when used with JSONField, which can lead to unauthorized data access and manipulation.
Vulnerability Detail
An issue was discovered in Django versions 5.0 before 5.0.8 and 4.2 before 4.2.15, where the QuerySet.values() and values_list() methods are susceptible to SQL injection via crafted JSON object keys passed as arguments. This vulnerability allows attackers to manipulate SQL queries, potentially leading to data leakage, unauthorized access, or data corruption. The vulnerability arises from improper handling of JSONField data types, which can be exploited if user input is not adequately sanitized.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the QuerySet.values() and values_list() methods with JSONField until the upgrade can be performed. Instead, consider using alternative methods to retrieve data that do not involve JSONField or ensure that any user input is properly sanitized before being passed to these methods.
Conclusion
The SQL injection vulnerability in Django's QuerySet methods poses a significant risk to applications using affected versions of the framework. It is crucial for developers to upgrade to the latest secure versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities in open-source software effectively.
See every vulnerability recorded for python-django →
FAQ
Django versions 5.0 before 5.0.8 and 4.2 before 4.2.15 are affected by this vulnerability.
SQL injection is a code injection technique that exploits a vulnerability in an application's software by allowing an attacker to interfere with the queries that an application makes to its database.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If an immediate upgrade is not possible, implement the suggested workaround by avoiding the use of QuerySet.values() and values_list() methods with JSONField until you can upgrade.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
