CVE-2023-47128: piccolo SQL Injection via named transaction savepoints
Summary
CVE-2023-47128: piccolo SQL Injection via named transaction savepoints. Affects piccolo versions < 1.1.1. Fixed in 1.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Piccolo is an open-source Python ORM (Object-Relational Mapping) library that provides a convenient way to interact with databases. It offers various features and supports multiple database backends, including Postgres and SQLite. However, the handling of named transaction savepoints in all database implementations of Piccolo is vulnerable to SQL Injection. This vulnerability arises due to user-provided input being passed directly to the connection.execute() function without proper escaping. As a result, an attacker can exploit this vulnerability to execute arbitrary SQL queries and potentially gain unauthorized access to the database.
Vulnerability Detail
The vulnerability in Piccolo's handling of named transaction savepoints allows an attacker to inject malicious SQL queries. This occurs because user input is not properly sanitized before being passed to the connection.execute() function. As a consequence, an attacker can manipulate the input to execute arbitrary SQL statements, potentially leading to unauthorized data access, data modification, or even a complete compromise of the database. The vulnerability affects all implementations of savepoints and savepoint methods in Piccolo, including Postgres and SQLite backends.
How To Fix
Minimum fixed version
1.1.1
This is the first release that contains the fix.
pip install --upgrade "piccolo==1.1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually sanitize and escape user input before passing it to the connection.execute() function. This involves properly escaping special characters and ensuring that the input is treated as data rather than executable code. However, it is important to note that manual sanitization can be error-prone and may not provide complete protection against all possible attack vectors. Therefore, applying the recommended fix is the best approach to mitigate this vulnerability.
Conclusion
The piccolo SQL Injection vulnerability in the handling of named transaction savepoints poses a significant risk to applications using the Piccolo ORM library. It allows attackers to execute arbitrary SQL queries and potentially gain unauthorized access to the database. To mitigate this vulnerability, developers should review their codebase, properly escape user input, and consider using parameterized queries or prepared statements. Keeping the Piccolo library up to date is also recommended to benefit from any security patches or fixes. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for piccolo →
FAQ
Piccolo is an open-source Python ORM library that simplifies database interactions and provides an intuitive way to work with databases.
SQL Injection is a type of security vulnerability where an attacker can manipulate SQL queries by injecting malicious input. This can lead to unauthorized access, data manipulation, or even a complete compromise of the database.
The vulnerability in Piccolo arises due to user-provided input being directly passed to the connection.execute() function without proper escaping. This allows an attacker to inject malicious SQL queries.
If exploited, this vulnerability can allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized data access, data modification, or a complete compromise of the database.
Developers should ensure that all strings passed to the connection.execute() function are properly escaped. This can be achieved by using parameterized queries or prepared statements to separate the SQL code from user input.
References
Related vulnerabilities
Recent vulnerabilities recorded for piccolo.
