CVE-2021-30459: SQL Injection in django-debug-toolbar
Summary
CVE-2021-30459: A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL expl... Affects django-debug-toolbar across 3 version ranges.
>= 0.10.0, < 1.11.1
>= 2.0, < 2.2.1
>= 3.0, < 3.2.1
Fixed in 1.11.1, 2.2.1 or 3.2.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
django-debug-toolbar is a Django application that provides a set of panels displaying various debug information about the current request/response. It helps developers debug their Django applications by showing detailed information about queries, cache, signals, and more. This package is widely used in Django projects to aid in development and debugging processes. However, versions before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 are vulnerable to a SQL Injection issue in the SQL Panel.
Vulnerability Detail
The SQL Injection vulnerability in django-debug-toolbar allows attackers to execute SQL statements by manipulating the raw_sql input field of the SQL explain, analyze, or select form. This can lead to unauthorized access, data leakage, or even complete compromise of the underlying database. The vulnerability arises due to insufficient input validation and sanitization, allowing malicious SQL code to be executed within the application's database context.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.10.0, < 1.11.11.11.1pip install --upgrade "django-debug-toolbar==1.11.1" -
>= 2.0, < 2.2.12.2.1pip install --upgrade "django-debug-toolbar==2.2.1" -
>= 3.0, < 3.2.13.2.1pip install --upgrade "django-debug-toolbar==3.2.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable or remove the SQL Panel from the django-debug-toolbar configuration. This can be achieved by modifying the toolbar configuration in the Django settings file. By removing the SQL Panel, the vulnerable functionality is no longer accessible, reducing the risk of exploitation. However, this workaround may impact the ability to debug and analyze SQL queries during development.
Conclusion
The SQL Injection vulnerability in django-debug-toolbar poses a significant risk to applications using vulnerable versions. It is highly recommended to upgrade to the fixed versions (1.11.1, 2.2.1, or 3.2.1) or apply the provided workaround to mitigate the issue. Regularly updating dependencies and staying informed about security vulnerabilities is crucial for maintaining the security of Django applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django-debug-toolbar →
FAQ
The vulnerability allows attackers to execute arbitrary SQL statements, potentially leading to unauthorized access, data leakage, or complete compromise of the database.
No, only versions before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 are vulnerable. It is recommended to upgrade to the fixed versions to mitigate the issue.
At the time of this advisory, there is no known public exploit available. However, it is important to apply the recommended fixes to prevent any potential exploitation.
Yes, this vulnerability can be exploited remotely if the affected application is accessible over the network. Attackers can send crafted requests to exploit the SQL Injection issue.
There is no evidence of active exploitation at the time of this advisory. However, it is crucial to apply the necessary patches to prevent any potential exploitation in the future.
