Internet Bug Bounty · Report #2646493

CVE-2024-42005: Potential SQL injection in QuerySet.values() and values_list()

Validstatus

highseverity

$4,263bounty

52upvotes

24 Aug 2024disclosed

Summary

CVE-2024-42005: Potential SQL injection in QuerySet.values() and values_list()

QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.

Thanks to Eyal Gabay of EyalSec for the report.

This issue has severity "high" according to the Django security policy.

How it was found

Hi IBB :)

I found SQL injection in django. you can see my cve (CVE-2024-42005) here: https://www.djangoproject.com/weblog/2024/aug/06/security-releases/

Impact

QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.

NVD rated the vulnerability sevirity as 9.8. https://nvd.nist.gov/vuln/detail/CVE-2024-42005

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original