CVE-2024-53908

Vulnerability

Description

CVE-2024-53908 is a SQL injection vulnerability in Django's django.db.models.fields.json.HasKey lookup when used with an Oracle database. The issue arises when untrusted data is passed as the left-hand side (lhs) value, allowing an attacker to inject arbitrary SQL. Applications using the jsonfield.has_key lookup via double underscores (__) are unaffected [3].

Exploitation

To exploit this vulnerability, an attacker must be able to supply untrusted input to the lhs of a HasKey lookup. This scenario typically occurs when user-controlled data is directly used in a database query without proper sanitization. The vulnerability is specific to Oracle databases, as the underlying SQL generation handles the lhs differently on that platform [4].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands on the Oracle database, potentially leading to data leakage, modification, or deletion. The severity depends on the database permissions of the Django application [3].

Mitigation

The Django team has released patched versions: 5.1.4, 5.0.10, and 4.2.17. Users are strongly advised to upgrade immediately. No workarounds are available for Oracle databases, but the issue does not affect other database backends [4].