CVE-2019-14234 PoC — Django SQL注入漏洞

Source

https://github.com/malvika-thakur/CVE-2019-14234

Associated Vulnerability

Title: Django SQL注入漏洞 (CVE-2019-14234)
Description:An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.

Description

POC-Django JSONField/HStoreField SQL Injection Vulnerability (CVE-2019-14234)

Readme

# POC-Django JSONField/HStoreField SQL Injection Vulnerability Exploit (CVE-2019-14234)
Django released a security update on August 1, 2019, which fixes a SQL injection vulnerability in the two model fields of JSONField and HStoreField.

Reference link: 

https://www.djangoproject.com/weblog/2019/aug/01/security-releases/
https://www.leavesongs.com/PENETRATION/django-jsonfield-cve-2019-14234.html

The vulnerability requires the developer to use JSONField/HStoreField; moreover, the field name of the queryset can be controlled. Django's built-in application Django-Admin is affected, which gives us an easy way to reproduce the vulnerability.

## Start Vulnerability Application
Compile and start a vulnerable Django 2.2.3 by executing the following command:


```
docker compose build
docker compose up -d
```

After the environment is started, you can see the home page of Django at http://your-ip:8000.

## Vulnerability Reproduce
First, log in to the Django-Admin `http://your-ip:8000/admin/` with username `admin` and password `a123123123`.

Then go to the list-view `http://your-ip:8000/admin/vuln/collection/` of the model `Collection`:

Add `detail__a'b=123` to the GET parameter, where `detail` is the JSONField:

http://your-ip:8000/admin/vuln/collection/?detail__a%27b=123

You can see that the single quote has been injected successfully, and the SQL statement reports an error:

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →