SQL Injection Vulnerability in Django's QuerySet Methods - python-django
Summary
DEBIAN-CVE-2024-42005: An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. Affects python-django versions < 3:4.2.15-1. Fixed in 3:4.2.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM (Object-Relational Mapping) system that allows developers to interact with databases using Python code. The vulnerability in question affects the QuerySet.values() and values_list() methods when used with models containing a JSONField, potentially allowing attackers to manipulate SQL queries through crafted JSON object keys.
Vulnerability Detail
An issue was discovered in Django versions 5.0 before 5.0.8 and 4.2 before 4.2.15. The vulnerability arises from the QuerySet.values() and values_list() methods, which are susceptible to SQL injection attacks when handling column aliases. This can occur if an attacker passes a specially crafted JSON object key as an argument, leading to unauthorized access to the database or manipulation of data. The technical aspect involves the improper sanitization of input, allowing malicious SQL code to be executed.
How To Fix
Minimum fixed version
3:4.2.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using QuerySet.values() and values_list() methods with JSONField models until the package is updated. Instead, consider using alternative methods for data retrieval that do not involve these vulnerable functions.
Conclusion
The SQL injection vulnerability in Django's QuerySet methods poses a significant risk to applications using affected versions. It is crucial to update to the patched version to mitigate this risk. For those unable to update immediately, alternative methods should be employed to safeguard against potential exploitation.
See every vulnerability recorded for python-django →
FAQ
The vulnerability is an SQL injection issue that affects Django's QuerySet methods when used with JSONField models.
Django versions 5.0 before 5.0.8 and 4.2 before 4.2.15 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is impacted by this vulnerability without needing to sign up.
If an immediate update is not possible, avoid using the vulnerable QuerySet methods with JSONField models as a temporary workaround.
Exploitation of this vulnerability could lead to unauthorized access to sensitive data, data manipulation, or even complete database compromise.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
