SQL Injection Vulnerability in SQLAlchemy: CVE-2019-7164
Summary
CVE-2019-7164: SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. Affects sqlalchemy across 2 version ranges.
< 1.2.18+ds1-2
< 47c245b90cd3cfe76bc0cf078f740d12bf7ba2d1
Fixed in 1.2.18+ds1-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SQLAlchemy is a popular SQL toolkit and Object-Relational Mapping (ORM) system for Python. It provides a full suite of well-known enterprise-level persistence patterns, designed for efficient and high-performing database access. The library is widely used in web applications and data-driven projects. However, versions up to 1.2.17 and 1.3.x through 1.3.0b2 are vulnerable to SQL injection attacks via the 'order_by' parameter, which can lead to unauthorized data access and manipulation.
Vulnerability Detail
CVE-2019-7164 is a critical SQL injection vulnerability found in SQLAlchemy, allowing attackers to manipulate SQL queries through the 'order_by' parameter. This vulnerability arises from improper validation of user input, which can lead to unauthorized access to sensitive data, data corruption, or even complete system compromise. The CVSS score for this vulnerability is 9.8, indicating a high severity level that necessitates immediate attention.
How To Fix
Minimum fixed version
1.2.18+ds1-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade sqlalchemyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider sanitizing the input for the 'order_by' parameter to prevent SQL injection. This can be achieved by implementing strict validation rules in your application code to ensure that only expected values are processed. For example, you can use a whitelist approach to allow only certain fields for ordering.
Conclusion
CVE-2019-7164 is a significant SQL injection vulnerability in SQLAlchemy that poses serious risks to applications using affected versions. Immediate action is required to upgrade to a secure version or implement workarounds to protect against potential attacks. Regular monitoring and vulnerability assessments are essential for maintaining application security.
See every vulnerability recorded for sqlalchemy →
FAQ
CVE-2019-7164 is a SQL injection vulnerability in SQLAlchemy that allows attackers to manipulate SQL queries through the 'order_by' parameter.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized data access, data corruption, and potentially complete system compromise.
It is recommended to upgrade to SQLAlchemy version 1.2.18 or later to mitigate this vulnerability.
Yes, you can implement input validation and sanitization for the 'order_by' parameter as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlalchemy.
