SQL Injection Vulnerability in Django Package: python-django Affected by Direct Usage of HasKey Lookup
Summary
DEBIAN-CVE-2024-53908: An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Affects python-django versions < 3:4.2.17-1. Fixed in 3:4.2.17-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-django package is a widely used web framework that allows developers to build web applications quickly and efficiently. It provides a robust set of tools for database management, URL routing, and templating. However, certain versions of Django are vulnerable to SQL injection attacks when using the django.db.models.fields.json.HasKey lookup with untrusted data in Oracle databases. This vulnerability can lead to unauthorized data access and manipulation.
Vulnerability Detail
An issue was discovered in Django versions 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The vulnerability arises from the direct usage of the django.db.models.fields.json.HasKey lookup, which is susceptible to SQL injection if untrusted data is used as the left-hand side (lhs) value. This can allow attackers to execute arbitrary SQL commands, potentially compromising the integrity and confidentiality of the database. Applications that utilize the jsonfield.has_key lookup via double underscores (__) are not affected by this vulnerability.
How To Fix
Minimum fixed version
3:4.2.17-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider avoiding the use of the django.db.models.fields.json.HasKey lookup with untrusted data as the lhs value. Instead, validate and sanitize any user input before using it in database queries to mitigate the risk of SQL injection.
Conclusion
In summary, the python-django package has a critical SQL injection vulnerability that affects specific versions. It is crucial to update to the patched version to safeguard your application from potential attacks. Additionally, implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for python-django →
FAQ
Django versions 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17 are affected by this SQL injection vulnerability.
SQL injection is a code injection technique that attackers use to exploit vulnerabilities in an application's software by inserting malicious SQL statements into an entry field for execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update the package, ensure to validate and sanitize all user inputs before using them in database queries to reduce the risk of SQL injection.
Vulert is a monitoring tool that uses a manifest file like package-lock.json to track and alert in real-time for open-source vulnerabilities in software, helping developers maintain secure applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
