CVE-2016-8640: SQL Injection in pycsw

Background

pycsw is an open source Python project that implements the Catalogue Service for the Web (CSW) standard. It provides a metadata and catalogue server for geospatial data. The vulnerability in pycsw versions before 2.0.2, 1.10.5, and 1.8.6 allows for SQL injection, which can lead to unauthorized access, data extraction, and even modifications to the database.

Vulnerability Detail

The SQL injection vulnerability in pycsw allows an attacker to manipulate SQL queries and execute arbitrary SQL code. This can result in unauthorized access to sensitive data, extraction of data from any table in the pycsw database, and on PostgreSQL, it can even allow for updates, inserts, deletes, and modifications to any table accessible by the database user. The vulnerability is rated as critical with a CVSS score of 9.1.

Workaround

If upgrading to a fixed version is not immediately possible, a temporary workaround is to sanitize and validate user input before using it in SQL queries. This can help prevent SQL injection attacks. Here is an example of how to sanitize user input in Python:

import psycopg2

def sanitize_input(input):
    # Sanitize and validate input
    sanitized_input = input.replace("'", "''")
    return sanitized_input

# Usage example
user_input = "' OR 1=1 --"
sanitized_input = sanitize_input(user_input)

# Use the sanitized input in SQL query
query = f"SELECT * FROM users WHERE username = '{sanitized_input}'"

# Execute the query
connection = psycopg2.connect(database='database', user='user', password='password', host='host', port='port')
cursor = connection.cursor()
cursor.execute(query)
results = cursor.fetchall()

Conclusion

The SQL injection vulnerability in pycsw versions before 2.0.2, 1.10.5, and 1.8.6 can have severe consequences, including unauthorized access to data and modifications to the database. It is crucial to upgrade to the fixed versions or apply the recommended workaround to mitigate the risk. Regularly updating and patching software is essential for maintaining security.

See every vulnerability recorded for pycsw →

FAQ