CVE-2019-7164
📋 TL;DR
CVE-2019-7164 is a SQL injection vulnerability in SQLAlchemy that allows attackers to inject malicious SQL code via the order_by parameter. This affects applications using SQLAlchemy 1.2.17 and earlier, or 1.3.x through 1.3.0b2, potentially leading to unauthorized data access or manipulation.
💻 Affected Systems
- SQLAlchemy
📦 What is this software?
Backports Sle by Opensuse
Communications Operations Monitor by Oracle
Communications Operations Monitor by Oracle
Leap by Opensuse
Leap by Opensuse
Sqlalchemy by Sqlalchemy
Sqlalchemy by Sqlalchemy
Sqlalchemy by Sqlalchemy
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, modification, or deletion, and potential remote code execution depending on database configuration.
Likely Case
Unauthorized data access, data exfiltration, or data manipulation in vulnerable applications.
If Mitigated
Limited impact with proper input validation and parameterized queries in place, though the vulnerability still exists at the ORM level.
🎯 Exploit Status
SQL injection via order_by is a well-known attack vector. Exploitation requires user input to reach the vulnerable order_by() method.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: SQLAlchemy 1.2.18, SQLAlchemy 1.3.0
Vendor Advisory: https://github.com/sqlalchemy/sqlalchemy/security/advisories/GHSA-4c4g-f62p-6x7m
Restart Required: Yes
Instructions:
1. Update SQLAlchemy using pip: 'pip install --upgrade sqlalchemy>=1.2.18' or 'pip install --upgrade sqlalchemy>=1.3.0'. 2. Restart all Python applications using SQLAlchemy. 3. Test application functionality after update.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict validation of user input for order_by parameters, allowing only whitelisted column names.
Use Parameterized Queries
allAvoid passing user input directly to order_by(). Instead, use SQLAlchemy's text() with bound parameters or validate input against allowed columns.
🧯 If You Can't Patch
- Implement strict input validation for all order_by parameters, allowing only pre-defined column names.
- Use web application firewalls (WAF) with SQL injection protection rules to block malicious order_by payloads.
🔍 How to Verify
Check if Vulnerable:
Check SQLAlchemy version in Python: 'python -c "import sqlalchemy; print(sqlalchemy.__version__)"' and compare with affected versions.Check Version:
python -c "import sqlalchemy; print(sqlalchemy.__version__)"Verify Fix Applied:
Verify SQLAlchemy version is 1.2.18 or higher, or 1.3.0 or higher using the same command.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries with ORDER BY clauses containing special characters or SQL keywords
- Database error logs showing SQL syntax errors from malformed ORDER BY statements
Network Indicators:
- HTTP requests with order_by parameters containing SQL injection payloads (e.g., UNION, SELECT, --)
SIEM Query:
source=web_logs AND (order_by="*UNION*" OR order_by="*SELECT*" OR order_by="*--*" OR order_by="*;*")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00087.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00016.html
- https://access.redhat.com/errata/RHSA-2019:0981
- https://access.redhat.com/errata/RHSA-2019:0984
- https://github.com/sqlalchemy/sqlalchemy/issues/4481
- https://lists.debian.org/debian-lts-announce/2019/03/msg00020.html
- https://lists.debian.org/debian-lts-announce/2021/11/msg00005.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00087.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00016.html
- https://access.redhat.com/errata/RHSA-2019:0981
- https://access.redhat.com/errata/RHSA-2019:0984
- https://github.com/sqlalchemy/sqlalchemy/issues/4481
- https://lists.debian.org/debian-lts-announce/2019/03/msg00020.html
- https://lists.debian.org/debian-lts-announce/2021/11/msg00005.html
- https://www.oracle.com/security-alerts/cpujan2021.html
