Executive brief
Django is a popular Python web framework used to build web applications. The QuerySet.annotate(), aggregate(), and extra() methods were vulnerable to SQL injection attacks through crafted dictionary parameters, allowing attackers to execute arbitrary SQL commands and potentially access or modify sensitive database records.
Technical details
A SQL injection vulnerability (CWE-89) exists in Django's QuerySet.annotate(), aggregate(), and extra() methods due to insufficient input validation of column alias names passed via keyword arguments. An attacker can exploit this by crafting a malicious dictionary with specially-crafted keys that bypass alias validation, allowing arbitrary SQL injection when the dictionary is expanded as **kwargs. This is a network-accessible vulnerability requiring no authentication or user interaction. Successful exploitation allows an attacker to execute arbitrary SQL queries, potentially leading to data exfiltration, modification, or deletion. Patches are available in Django 2.2.28, 3.2.13, and 4.0.4 or later.
Affected products
- Django Django 2.2 before 2.2.28, 3.2 before 3.2.13, 4.0 before 4.0.4
Timeline
- 2022-04-11: disclosed
- 2022-04-13: advisory
- 2022-04-11: patched: Patches available in Django 2.2.28, 3.2.13, and 4.0.4