Django up to 1.11.27/2.2.9/3.0.2 sql injection

Summaryinfo

A vulnerability was found in Django up to 1.11.27/2.2.9/3.0.2 and classified as critical. This vulnerability affects unknown code. Such manipulation leads to sql injection. This vulnerability is documented as CVE-2020-7471. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Django up to 1.11.27/2.2.9/3.0.2 (Content Management System). Affected by this issue is an unknown code. The manipulation with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.

The weakness was released 02/03/2020 (oss-sec). The advisory is shared for download at openwall.com. This vulnerability is handled as CVE-2020-7471 since 01/21/2020. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1505.

Upgrading to version 1.11.28, 2.2.10 or 3.0.3 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• Django

Version

• 1.11.0
• 1.11.1
• 1.11.2
• 1.11.3
• 1.11.4
• 1.11.5
• 1.11.6
• 1.11.7
• 1.11.8
• 1.11.9
• 1.11.10
• 1.11.11
• 1.11.12
• 1.11.13
• 1.11.14
• 1.11.15
• 1.11.16
• 1.11.17
• 1.11.18
• 1.11.19
• 1.11.20
• 1.11.21
• 1.11.22
• 1.11.23
• 1.11.24
• 1.11.25
• 1.11.26
• 1.11.27
• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.7
• 2.2.8
• 2.2.9
• 3.0.0
• 3.0.1
• 3.0.2

License

• open-source

Website

• Product: https://github.com/django/django/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion