SQL Injection Vulnerability in SQLAlchemy Package
Summary
CVE-2019-7548: SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled. Affects sqlalchemy across 2 version ranges.
< 1.2.18+ds1-2
< 47c245b90cd3cfe76bc0cf078f740d12bf7ba2d1
Fixed in 1.2.18+ds1-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SQLAlchemy is a popular SQL toolkit and Object-Relational Mapping (ORM) system for Python. It provides a full suite of well-known enterprise-level persistence patterns, designed for efficient and high-performing database access. However, SQLAlchemy versions prior to 1.2.18 are vulnerable to SQL injection attacks when the 'group_by' parameter is manipulated, potentially allowing attackers to execute arbitrary SQL commands.
Vulnerability Detail
The vulnerability, identified as CVE-2019-7548, arises from improper handling of user-controlled input in the 'group_by' parameter. This flaw can lead to SQL injection, where an attacker can craft malicious input to manipulate SQL queries, potentially gaining unauthorized access to sensitive data or executing harmful commands on the database. The severity of this vulnerability is reflected in its CVSS score of 7.8, indicating a high risk to applications using affected versions of SQLAlchemy.
How To Fix
Minimum fixed version
1.2.18+ds1-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade sqlalchemyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider sanitizing user inputs for the 'group_by' parameter to prevent injection attacks. Implementing strict validation rules for input data can help mitigate the risk until an upgrade is performed.
Conclusion
The SQL injection vulnerability in SQLAlchemy (CVE-2019-7548) poses a significant risk to applications using affected versions. It is crucial to upgrade to version 1.2.18 or later to mitigate this risk. Additionally, developers should implement input validation as a temporary measure until an upgrade can be performed.
See every vulnerability recorded for sqlalchemy →
FAQ
SQLAlchemy is a Python library that facilitates database interaction through an ORM, allowing developers to work with databases using Python objects instead of SQL queries.
SQL injection is a code injection technique that exploits vulnerabilities in an application's software by inserting or 'injecting' malicious SQL code into a query.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can lead to unauthorized access to sensitive data, data manipulation, or even complete control over the database.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlalchemy.
