CVE-2021-30459: SQL Injection via django-debug-toolbar
Summary
CVE-2021-30459: SQL Injection via in django-debug-toolbar. Affects django-debug-toolbar across 3 version ranges.
>= 0.10.0, < 1.11.1
>= 2.0a1, < 2.2.1
>= 3.0a1, < 3.2.1
Fixed in 1.11.1, 2.2.1 or 3.2.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django Debug Toolbar is a popular debugging tool for Django web applications. It provides various panels that display information about the current request/response, database queries, and more. However, a vulnerability has been discovered in django-debug-toolbar that allows attackers to execute SQL injection attacks by manipulating the raw_sql input of the SQL explain, analyze, or select forms.
Vulnerability Detail
The vulnerability in django-debug-toolbar allows attackers to execute arbitrary SQL queries by modifying the raw_sql input and submitting the form. This can lead to unauthorized access to sensitive data, data manipulation, or even remote code execution. It is important to note that this vulnerability is considered high severity, especially if the toolbar is used in a production environment.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.10.0, < 1.11.11.11.1pip install --upgrade "django-debug-toolbar==1.11.1" -
>= 2.0a1, < 2.2.12.2.1pip install --upgrade "django-debug-toolbar==2.2.1" -
>= 3.0a1, < 3.2.13.2.1pip install --upgrade "django-debug-toolbar==3.2.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the patched versions of django-debug-toolbar.
Conclusion
The SQL injection vulnerability in django-debug-toolbar can be addressed by upgrading to the patched versions. It is important to take immediate action to protect your application from potential attacks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for django-debug-toolbar →
FAQ
Django Debug Toolbar is a debugging tool for Django web applications. It provides various panels to display information about the current request/response, database queries, and more.
The SQL injection vulnerability occurs due to improper handling of user-supplied input in the raw_sql input of the SQL explain, analyze, or select forms in django-debug-toolbar.
With this vulnerability, an attacker can execute arbitrary SQL queries, potentially leading to unauthorized access to sensitive data, data manipulation, or even remote code execution.
Yes, this vulnerability is considered high severity, especially if django-debug-toolbar is used in a production environment.
To fix this vulnerability, it is recommended to upgrade to the latest patched versions of django-debug-toolbar, depending on the major version you are using.
