Critical SQL Injection Vulnerability in Python Django Package
Summary
UBUNTU-CVE-2024-53908: An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Affects python-django versions < 3:4.2.11-1ubuntu1.4. Fixed in 3:4.2.11-1ubuntu1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python Django is a high-level web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and provides a robust set of features, including an ORM (Object-Relational Mapping) system, which allows developers to interact with databases using Python code. However, a recent vulnerability has been identified that affects specific versions of Django, particularly when using Oracle databases, making it susceptible to SQL injection attacks.
Vulnerability Detail
An issue was discovered in Django versions 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The vulnerability arises from the direct usage of the django.db.models.fields.json.HasKey lookup when an Oracle database is used. If untrusted data is used as a left-hand side (lhs) value, it can lead to SQL injection, allowing attackers to execute arbitrary SQL commands. This can result in unauthorized data access, data manipulation, or even complete database compromise. Applications that utilize the jsonfield.has_key lookup via double underscores are not affected by this vulnerability.
How To Fix
Minimum fixed version
3:4.2.11-1ubuntu1.4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, avoid using the django.db.models.fields.json.HasKey lookup with untrusted data as the lhs value. Instead, consider using safer alternatives or sanitizing inputs before they are processed by the lookup.
Conclusion
In summary, a critical SQL injection vulnerability has been identified in specific versions of the Python Django package when used with Oracle databases. It is crucial to update to the patched version to safeguard against potential attacks. Implementing workarounds and utilizing tools like Vulert can further enhance security measures.
See every vulnerability recorded for python-django →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
Django versions 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17 are affected by this vulnerability.
The vulnerability specifically affects applications using Oracle databases.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
If immediate updates are not possible, ensure that untrusted data is not used as the lhs value in the HasKey lookup to mitigate the risk of SQL injection.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
