CVE-2021-35042
📋 TL;DR
This vulnerability allows SQL injection in Django applications when untrusted user input is passed to QuerySet.order_by() methods. Attackers can execute arbitrary SQL commands, potentially compromising database integrity and confidentiality. All Django applications using affected versions with untrusted order_by input are vulnerable.
💻 Affected Systems
- Django
📦 What is this software?
Django by Djangoproject
Django by Djangoproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise including data theft, modification, deletion, and potential remote code execution via database functions.
Likely Case
Data exfiltration, privilege escalation, and unauthorized data access through SQL injection.
If Mitigated
Limited impact if input validation prevents untrusted data from reaching order_by() or if database permissions are properly restricted.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited and weaponized tools exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Django 3.1.13 or 3.2.5
Vendor Advisory: https://www.djangoproject.com/weblog/2021/jul/01/security-releases/
Restart Required: Yes
Instructions:
1. Backup your Django project. 2. Update Django using pip: 'pip install Django==3.1.13' or 'pip install Django==3.2.5'. 3. Restart your Django application server. 4. Test application functionality.
🔧 Temporary Workarounds
Input Validation Workaround
allValidate and sanitize all user input before passing to order_by() methods
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns in order_by parameters
🧯 If You Can't Patch
- Implement strict input validation to ensure only whitelisted values reach order_by() methods
- Apply database-level controls to limit user permissions and prevent data exfiltration
🔍 How to Verify
Check if Vulnerable:
Check Django version with 'python -m django --version' and verify it's in affected range (3.1.x < 3.1.13 or 3.2.x < 3.2.5)Check Version:
python -m django --versionVerify Fix Applied:
Confirm Django version is 3.1.13 or higher for 3.1.x branch, or 3.2.5 or higher for 3.2.x branch📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed order_by attempts
- Suspicious parameter values in Django request logs
Network Indicators:
- SQL injection patterns in HTTP parameters
- Unusual database traffic from application servers
SIEM Query:
search 'order_by' AND ('sql' OR 'injection' OR 'union' OR 'select') in web server logs🔗 References
- https://docs.djangoproject.com/en/3.2/releases/security/
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SS6NJTBYWOX6J7G4U3LUOILARJKWPQ5Y/
- https://security.netapp.com/advisory/ntap-20210805-0008/
- https://www.djangoproject.com/weblog/2021/jul/01/security-releases/
- https://www.openwall.com/lists/oss-security/2021/07/02/2
- https://docs.djangoproject.com/en/3.2/releases/security/
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SS6NJTBYWOX6J7G4U3LUOILARJKWPQ5Y/
- https://security.netapp.com/advisory/ntap-20210805-0008/
- https://www.djangoproject.com/weblog/2021/jul/01/security-releases/
- https://www.openwall.com/lists/oss-security/2021/07/02/2
