CVE-2022-28346: SQL Injection in Django

Background

Django is a popular Python web framework that provides a high-level, Pythonic interface for interacting with databases. It is widely used for building web applications and follows the model-view-controller (MVC) architectural pattern. However, Django versions 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4 are vulnerable to a SQL injection attack. This vulnerability affects the QuerySet.annotate(), aggregate(), and extra() methods when used with a crafted dictionary as the **kwargs parameter. The vulnerability allows an attacker to inject malicious SQL code into column aliases, leading to potential unauthorized access, data manipulation, or data leakage.

Vulnerability Detail

The SQL injection vulnerability in Django arises due to improper handling of column aliases in the QuerySet.annotate(), aggregate(), and extra() methods. When a dictionary is passed as the **kwargs parameter, the vulnerability allows an attacker to inject arbitrary SQL code into the column aliases. This can lead to the execution of unintended SQL queries, potentially compromising the integrity and confidentiality of the database. The vulnerability has a CVSS score of 9.8, indicating its critical severity.

pip install --upgrade "django==6.1.2"

Workaround

As a temporary workaround, developers can manually validate and sanitize the column aliases before passing them to the vulnerable methods. This can be done by ensuring that the aliases only contain safe characters and do not include any user-controlled input. Here is an example of how to sanitize the column aliases in Django:

from django.db.models import QuerySet

def sanitize_aliases(aliases):
    sanitized_aliases = {}
    for key, value in aliases.items():
        # Perform validation and sanitization
        sanitized_value = sanitize(value)
        sanitized_aliases[key] = sanitized_value
    return sanitized_aliases

# Usage
aliases = {
    'alias1': 'SELECT * FROM users',
    'alias2': 'SELECT * FROM sensitive_data'
}
sanitized_aliases = sanitize_aliases(aliases)
queryset.annotate(**sanitized_aliases)

Conclusion

In conclusion, Django versions 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4 are vulnerable to a critical SQL injection attack. It is crucial to upgrade to the fixed versions or apply the recommended workarounds to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for django →

FAQ