CVE-2023-47128 piccolo SQL Injection via named transaction savepoints
SQL injection in Piccolo ORM allows attackers to read, modify database data, or execute code if savepoint names are user-controlled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-47128?
CVE-2023-47128 is a critical SQL injection vulnerability in piccolo-orm piccolo, published on 10 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction `savepoints` in all database implementations is vulnerable to SQL Injection via f-strings. While the likelihood of an end developer exposing a `savepoints` `name` parameter to a user is highly unlikely, it would not be unheard of. If a malicious user was able to abuse this functionality they would have essentially direct access to the database and the ability to modify data to the level of permissions associated with the database user. A non exhaustive list of actions possible based on database permissions is: Read all data stored in the database, including usernames and password hashes; insert arbitrary data into the database, including modifying existing records; and gain a shell on the underlying server. Version 1.1.1 fixes this issue.
Weakness: CWE-89
Which versions are affected by CVE-2023-47128?
3 open source packages ship an affected version, including piccolo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
piccolo PyPI | All versions | 1.1.1 |
piccolo PyPI | All versions | 1.1.1 |
piccolo PyPI | All versions | 1.1.1 |
Products include Piccolo-Orm Piccolo.
How do I fix CVE-2023-47128?
Upgrade piccolo to 1.1.1 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2023-47128 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-47128 exists.
Other vulnerabilities in piccolo-orm piccolo
Sources
Also known as GHSA-xq59-7jf3-rjc6, PYSEC-2023-241.