CVE-2019-7548: SQL Injection in SQLAlchemy
Summary
CVE-2019-7548: SQLAlchemy is vulnerable to SQL Injection via group_by parameter. Affects sqlalchemy versions < 1.2.19. Fixed in 1.2.19. How to fix ↓
Also tracked for
- sqlalchemy · Debian:11
The same CVE-2019-7548 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SQLAlchemy is a popular Python SQL toolkit and Object-Relational Mapping (ORM) library. It provides a set of high-level API for interacting with databases, making it easier to work with SQL databases in Python. However, SQLAlchemy versions prior to 1.3.0 are vulnerable to SQL Injection attacks when the 'group_by' parameter can be controlled.
Vulnerability Detail
The vulnerability, identified as CVE-2019-7548, is an instance of Improper Neutralization of Special Elements used in an SQL Command (CWE-89). It allows an attacker to inject malicious SQL code into the 'group_by' parameter, potentially leading to unauthorized access, data manipulation, or even remote code execution. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.8.
How To Fix
Minimum fixed version
1.2.19
This is the first release that contains the fix.
pip install --upgrade "sqlalchemy==1.2.19"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a temporary workaround can be implemented. It is advised to carefully validate and sanitize user input before using it in SQL queries. This can be achieved by using parameterized queries or prepared statements, which ensure that user-supplied data is treated as data and not executable code.
Conclusion
SQLAlchemy versions prior to 1.3.0 are vulnerable to SQL Injection. It is crucial to upgrade to the fixed version or implement proper input validation to mitigate the risk. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sqlalchemy →
FAQ
SQLAlchemy is a Python SQL toolkit and ORM library that provides a high-level API for interacting with databases.
SQL Injection is a type of security vulnerability that allows an attacker to manipulate SQL queries by injecting malicious SQL code.
The vulnerability allows an attacker to execute arbitrary SQL commands, potentially leading to unauthorized access, data manipulation, or remote code execution.
To fix this vulnerability, upgrade SQLAlchemy to version 1.3.0 or higher. Alternatively, sanitize and validate user input before using it in SQL queries.
Yes, you can sanitize and validate user input before using it in SQL queries as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlalchemy.
