CVE-2024-24811: products-sqlalchemyda Unauthenticated Arbitrary SQL Query Execution Vulnerability
Summary
CVE-2024-24811: SQLAlchemyDA unauthenticated arbitrary SQL query execution. Affects products-sqlalchemyda versions < 2.2. Fixed in 2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
products-sqlalchemyda is a Python package that integrates SQLAlchemy with Zope's database adapter, allowing developers to interact with databases using SQLAlchemy's ORM capabilities. It is widely used in web applications that require database interactions. However, a critical vulnerability has been identified that allows unauthenticated users to execute arbitrary SQL queries on the connected database, posing significant security risks.
Vulnerability Detail
The vulnerability arises from insufficient access controls within the products-sqlalchemyda package, enabling unauthenticated users to send arbitrary SQL commands to the database. This could lead to unauthorized data access, data manipulation, or even complete database compromise. The vulnerability affects all users of the package, regardless of their authentication status, making it a severe security concern.
How To Fix
Minimum fixed version
2.2
This is the first release that contains the fix.
pip install --upgrade "products-sqlalchemyda==2.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no workarounds available for this vulnerability. Users are strongly urged to upgrade to the patched version 2.2 to mitigate the risk.
Conclusion
The products-sqlalchemyda package has a critical vulnerability that allows unauthenticated arbitrary SQL query execution. Users must upgrade to version 2.2 to mitigate this risk. Regular monitoring of dependencies using tools like Vulert is recommended to stay informed about potential vulnerabilities.
See every vulnerability recorded for products-sqlalchemyda →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
All users of the products-sqlalchemyda package are affected, regardless of their authentication status.
Failure to upgrade may result in unauthorized access to your database, leading to data breaches or loss.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
