CVE-2023-39654

Vulnerability

A SQL injection vulnerability exists in the abupy library up to version v0.4.0, specifically in the abupy.MarketBu.ABuSymbol.search_to_symbol_dict function [1][2]. The function is designed to search for stock symbols but fails to sanitize user-supplied input, allowing an attacker to inject arbitrary SQL commands into the underlying SQLite query [2]. The affected versions are all releases up to and including v0.4.0 [1].

Exploitation

An attacker can exploit this vulnerability by calling search_to_symbol_dict with a crafted string argument [2]. No authentication or special privileges are required because the function is a public API intended for normal use [2]. The payload uses a UNION SELECT statement with a conditional expression (e.g., sqlite_version() = '3.31.1') to perform blind SQL injection [2]. For example, the payload "us----' union select case when (sqlite_version() = '3.31.1') then 'usJASNW' else 'usTROVW' end where ''='" returns different results depending on the truth of the condition, confirming SQL code execution [2].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL queries against the SQLite database used by abupy [2]. This can lead to information disclosure, such as extracting database version, table contents, or other sensitive data stored in the database [2]. The proof-of-concept demonstrates the ability to evaluate arbitrary boolean conditions, enabling blind data extraction [2]. The attacker gains the ability to read any data accessible to the application, potentially compromising confidentiality.

Mitigation

As of the publication date (2023-09-05), no patched version has been released [1][2]. The latest version v0.4.0 remains vulnerable. Users should avoid passing untrusted input to the search_to_symbol_dict function and consider implementing input validation or parameterized queries as a workaround. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Monitor the official repository [1] for future updates.