CVE-2024-5753: Vanna Package Vulnerable to SQL Injection
Summary
CVE-2024-5753: Vanna vulnerable to SQL Injection. Affects vanna versions < 0.3.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vanna is an AI-driven package available on PyPI that provides various functionalities for data processing and analysis. It is designed to integrate seamlessly with Python applications, offering a user-friendly interface and efficient performance. However, version 0.3.4 of Vanna has been identified as vulnerable to SQL injection attacks, which can compromise the security of applications utilizing this package.
Vulnerability Detail
The vulnerability in Vanna arises from improper handling of SQL queries in critical functions, specifically pg_read_file(). This flaw allows unauthenticated remote users to execute arbitrary SQL commands, potentially leading to unauthorized access to sensitive files on the server, such as /etc/passwd. The exploitation of this vulnerability can result in severe data breaches and unauthorized data exposure, making it a significant security concern for users of the affected version.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider restricting access to the API endpoints that utilize the vulnerable SQL queries until the package can be updated. Additionally, implementing input validation and sanitization can help mitigate the risk of SQL injection attacks.
Conclusion
The SQL injection vulnerability in Vanna version 0.3.4 poses a significant risk to applications using this package. It is crucial for users to update to a patched version to safeguard against potential attacks. Implementing workarounds can provide temporary relief until the update is completed.
See every vulnerability recorded for vanna →
FAQ
SQL injection is a code injection technique that exploits vulnerabilities in an application's software by allowing attackers to manipulate SQL queries, potentially gaining unauthorized access to data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential impacts include unauthorized access to sensitive files, data breaches, and the possibility of further attacks on the server.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity level.
If immediate updates are not possible, implement access controls and input validation as temporary measures to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for vanna.
