CVE-2024-53908
📋 TL;DR
This vulnerability allows SQL injection attacks in Django applications when using the django.db.models.fields.json.HasKey lookup directly with untrusted data on Oracle databases. It affects Django applications running on Oracle database backends with specific vulnerable versions. Applications using the jsonfield.has_key lookup via __ (double underscore) are not affected.
💻 Affected Systems
- Django
📦 What is this software?
Django by Djangoproject
Django by Djangoproject
Django by Djangoproject
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise allowing data theft, modification, or deletion, and potential remote code execution depending on database configuration.
Likely Case
Data exfiltration, unauthorized data access, or database manipulation through SQL injection.
If Mitigated
Limited impact if input validation and parameterized queries are used elsewhere, but this specific vector remains vulnerable.
🎯 Exploit Status
Exploitation requires specific conditions (Oracle DB, direct HasKey usage with untrusted input) but is straightforward when those conditions are met.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Django 5.1.4, Django 5.0.10, Django 4.2.17
Vendor Advisory: https://docs.djangoproject.com/en/dev/releases/security/
Restart Required: Yes
Instructions:
1. Upgrade Django to patched version: pip install Django==5.1.4 (or appropriate version). 2. Restart your Django application server. 3. Test application functionality.
🔧 Temporary Workarounds
Avoid direct HasKey usage
allReplace direct django.db.models.fields.json.HasKey lookups with jsonfield.has_key lookups using __ syntax
Input validation
allImplement strict input validation and sanitization for any data used in HasKey lookups
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all data that could reach HasKey lookups
- Use jsonfield.has_key lookups with __ syntax instead of direct HasKey usage
🔍 How to Verify
Check if Vulnerable:
Check Django version and codebase for direct usage of django.db.models.fields.json.HasKey with untrusted data on Oracle DBCheck Version:
python -m django --versionVerify Fix Applied:
Verify Django version is 5.1.4, 5.0.10, or 4.2.17 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries from Django application, especially with JSON operations
- Database error logs showing malformed SQL
Network Indicators:
- Unusual database traffic patterns from application servers
SIEM Query:
source="django.logs" AND ("HasKey" OR "json lookup" OR "SQL error")