SQL injection in Django - CVE-2022-28346

Vulnerability identifier: #VU62050

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-28346

CWE-ID: CWE-89

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data within the QuerySet.annotate(), aggregate(), and extra() methods. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Django
Gentoo Linux
Debian Linux
Arch Linux
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
HPE Helion Openstack
Ubuntu
openSUSE Leap
openEuler
Fedora
python-future (Red Hat package)
createrepo_c (Red Hat package)
pulpcore-selinux (Red Hat package)
python-django20 (Red Hat package)
python3-django (Red Hat package)
python-jinja2 (Red Hat package)
python-cryptography (Red Hat package)
python-django (Red Hat package)
openstack-heat-templates
python-ecdsa (Red Hat package)
rhui-cds-plugin-fetcher (Red Hat package)
rhui-cds-plugin-authorizer-cert (Red Hat package)
python-naya (Red Hat package)
python-pyjwkest (Red Hat package)
python-url-normalize (Red Hat package)
ansible-collection-community-crypto (Red Hat package)
python-pyjwt (Red Hat package)
python-django (Ubuntu package)
python3-django (Ubuntu package)
python-Django1
python-Django
python-markupsafe (Red Hat package)
python3-Django
python-django
python-django-help
python-django (Debian package)
python-pulp-container-client (Red Hat package)
python-pulp-container (Red Hat package)
rubygem-puma-debugsource
ruby2.1-rubygem-puma-debuginfo
ruby2.1-rubygem-puma
python-requests (Red Hat package)
rabbitmq-server
rabbitmq-server-plugins
python-pycryptodomex (Red Hat package)
python-pulpcore (Red Hat package)
python-pulp-rpm (Red Hat package)
openstack-murano-engine
openstack-murano
openstack-murano-api
openstack-murano-doc
python-murano
venv-openstack-murano-x86_64
rhui-installer (Red Hat package)
rhui-tools (Red Hat package)
automation-controller (Red Hat package)
dev-python/django
grafana
grafana-debuginfo
ardana-cobbler
ardana-ansible
ardana-tempest
venv-openstack-heat-x86_64
venv-openstack-horizon-x86_64
venv-openstack-horizon-hpe-x86_64
venv-openstack-neutron-x86_64
openstack-horizon-plugin-gbp-ui
python-horizon-plugin-gbp-ui
python-neutron-gbp
openstack-neutron-gbp
venv-openstack-nova-x86_64
openstack-nova-serialproxy
openstack-nova-scheduler
openstack-nova-vncproxy
python-nova
openstack-nova-console
openstack-nova
openstack-nova-api
openstack-nova-cells
openstack-nova-placement-api
openstack-nova-compute
openstack-nova-conductor
openstack-nova-novncproxy
python-pyOpenSSL (Red Hat package)
Ansible Automation Platform
Red Hat Update Infrastructure (RHUI)
Red Hat OpenStack

Install updates from vendor's website.

Django - addressed in versions 2.2.28, 3.2.13, 4.0.4
python-future (Red Hat package) - update to 0.18.2-5.el8ui
createrepo_c (Red Hat package) - update to 0.20.0-2.el8ui
pulpcore-selinux (Red Hat package) - addressed in versions 1.3.0-1.el8ui, 1.3.1-1.el8ap
python-django20 (Red Hat package) - addressed in versions 2.0.13-17.el8ost, 2.0.13-18.el8ost
Ansible Automation Platform - update to 2.1.2
python3-django (Red Hat package) - update to 2.2.28-1.el7pc
python-jinja2 (Red Hat package) - update to 3.0.3-1.el8pc
python-cryptography (Red Hat package) - update to 3.1.1-2.el8ui
python-django (Red Hat package) - addressed in versions 3.2.13-1.el8pc, 3.2.13-2.el8ui
Red Hat Update Infrastructure (RHUI) - update to 4.1.1
Red Hat OpenStack - addressed in versions 16.1.9, 16.2.3
openstack-heat-templates - addressed in versions 0.0.0+git.1654529662.75fa04a-3.27.1, 0.0.0+git.1654529662.75fa04a7-3.15.1
python-ecdsa (Red Hat package) - update to 0.14.1-2.el8ui
rhui-cds-plugin-fetcher (Red Hat package) - update to 1.0.5-1.el8ui
rhui-cds-plugin-authorizer-cert (Red Hat package) - update to 1.0.5-1.el8ui
python-naya (Red Hat package) - update to 1.1.1-1.el8pc
python-pyjwkest (Red Hat package) - update to 1.4.2-6.el8ui
python-url-normalize (Red Hat package) - update to 1.4.3-4.el8ui
ansible-collection-community-crypto (Red Hat package) - update to 1.7.0-4.el8ui
python-pyjwt (Red Hat package) - update to 1.7.1-8.el8ui
python-django (Ubuntu package) - addressed in versions 1.8.71ubuntu5.15+esm5, 1:1.11.11-1ubuntu1.17
python3-django (Ubuntu package) - addressed in versions 1.8.71ubuntu5.15+esm5, 1:1.11.11-1ubuntu1.17, 2:2.2.12-1ubuntu0.11, 2:2.2.24-1ubuntu1.4
python-Django1 - update to 1.11.29-3.40.1
python-Django - update to 1.11.29-3.42.1
python-markupsafe (Red Hat package) - update to 2.0.1-2.el8pc
python3-Django - update to 2.0.7-150000.1.27.1
python3-Django - update to 2.2.27-2
python-django - update to 2.2.27-2
python-django-help - update to 2.2.27-2
python-django (Debian package) - update to 2:2.2.28-1~deb11u1
python-pulp-container-client (Red Hat package) - update to 2.7.1-6.el8ui
python-pulp-container (Red Hat package) - update to 2.10.3-2.el8ui
rubygem-puma-debugsource - addressed in versions 2.16.0-3.18.1, 2.16.0-4.18.1
ruby2.1-rubygem-puma-debuginfo - addressed in versions 2.16.0-3.18.1, 2.16.0-4.18.1
ruby2.1-rubygem-puma - addressed in versions 2.16.0-3.18.1, 2.16.0-4.18.1
python-requests (Red Hat package) - update to 2.27.1-2.el8ui
rabbitmq-server - addressed in versions 3.6.16-3.13.1, 3.6.16-4.3.1
rabbitmq-server-plugins - addressed in versions 3.6.16-3.13.1, 3.6.16-4.3.1
python-pycryptodomex (Red Hat package) - update to 3.14.1-2.el8ui
python-pulpcore (Red Hat package) - addressed in versions 3.15.9-2.el8pc, 3.17.6-3.el8ui
python-pulp-rpm (Red Hat package) - update to 3.17.5-2.el8ui
openstack-murano-engine - update to 4.0.2~dev3-3.12.1
openstack-murano - update to 4.0.2~dev3-3.12.1
openstack-murano-api - update to 4.0.2~dev3-3.12.1
openstack-murano-doc - update to 4.0.2~dev3-3.12.1
python-murano - update to 4.0.2~dev3-3.12.1
venv-openstack-murano-x86_64 - update to 4.0.2~dev3-12.38.1
python-django - addressed in versions 4.0.10-1.fc37, 4.0.10-1.fc38
rhui-installer (Red Hat package) - update to 4.1.1.8-1.el8ui
rhui-tools (Red Hat package) - update to 4.1.1.16-1.el8ui
automation-controller (Red Hat package) - update to 4.1.2-2.el8ap
dev-python/django - update to 5.2.1
grafana - addressed in versions 6.7.4-3.29.1, 6.7.4-4.23.1
grafana-debuginfo - addressed in versions 6.7.4-3.29.1, 6.7.4-4.23.1
ardana-cobbler - addressed in versions 8.0+git.1660773402.d845a45-3.47.1, 9.0+git.1660747489.119efcd-3.19.1
ardana-ansible - addressed in versions 8.0+git.1660773729.3789a6d-3.85.1, 9.0+git.1660748476.c118d23-3.32.1
ardana-tempest - update to 9.0+git.1651855288.a2341ad-3.22.1
venv-openstack-heat-x86_64 - addressed in versions 9.0.8~dev22-12.45.1, 11.0.4~dev4-3.37.1
venv-openstack-horizon-x86_64 - addressed in versions 12.0.5~dev6-14.48.1, 14.1.1~dev11-4.41.1
venv-openstack-horizon-hpe-x86_64 - update to 12.0.5~dev6-14.48.1
venv-openstack-neutron-x86_64 - update to 13.0.8~dev206-6.41.1
openstack-horizon-plugin-gbp-ui - update to 14.0.1~dev4-3.12.1
python-horizon-plugin-gbp-ui - update to 14.0.1~dev4-3.12.1
python-neutron-gbp - update to 14.0.1~dev46-3.34.1
openstack-neutron-gbp - update to 14.0.1~dev46-3.34.1
venv-openstack-nova-x86_64 - update to 18.3.1~dev92-3.41.1
openstack-nova-serialproxy - update to 18.3.1~dev92-3.43.1
openstack-nova-scheduler - update to 18.3.1~dev92-3.43.1
openstack-nova-vncproxy - update to 18.3.1~dev92-3.43.1
python-nova - update to 18.3.1~dev92-3.43.1
openstack-nova-console - update to 18.3.1~dev92-3.43.1
openstack-nova - update to 18.3.1~dev92-3.43.1
openstack-nova-api - update to 18.3.1~dev92-3.43.1
openstack-nova-cells - update to 18.3.1~dev92-3.43.1
openstack-nova-placement-api - update to 18.3.1~dev92-3.43.1
openstack-nova-compute - update to 18.3.1~dev92-3.43.1
openstack-nova-conductor - update to 18.3.1~dev92-3.43.1
openstack-nova-novncproxy - update to 18.3.1~dev92-3.43.1
python-pyOpenSSL (Red Hat package) - update to 19.1.0-3.el8ui

• Exploit #7902 - CVE-2022-28346 () (May 27, 2022)
• Exploit #7842 - CVE-2022-28346 (An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary ex (May 16, 2022)
• Exploit #7690 - CVE-2022-28346 (Django QuerySet.annotate(), aggregate(), extra() SQL 注入) (April 26, 2022)
• Exploit #7689 - CVE-2022-28346 (SQL injection in QuerySet.annotate(), aggregate(), and extra()) (April 25, 2022)

• https://www.djangoproject.com/weblog/2022/apr/11/security-releases/

• Multiple SQL injection vulnerabilities in Django
• Ubuntu update for python-django
• Ubuntu update for python-django
• Arch Linux update for python-django
• Red Hat OpenStack Platform 16.2 update for python-django20
• Multiple vulnerabilities in Red Hat Update Infrastructure (RHUI)
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.1
• Red Hat Ansible Automation Platform 1.2 update for Django
• SUSE update for ardana-ansible, ardana-cobbler, grafana, openstack-heat-templates, openstack-murano, python-Django, rabbitmq-server, rubygem-puma
• SUSE update for ardana-ansible, ardana-cobbler, ardana-tempest, grafana, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-neutron-gbp, openstack-nova, python-Django1, rabbitmq-server, rubygem-puma
• Debian update for python-django
• Red Hat OpenStack Platform 16.1 update for python-django20
• Fedora 38 update for python-django
• Fedora 37 update for python-django
• openEuler update for python-django
• SUSE update for python-Django
• Gentoo update for Django