CVE-2024-36039: PyMySQL SQL Injection Vulnerability

CVE-2024-36039 Overview

CVE-2024-36039 is a SQL injection vulnerability affecting PyMySQL through version 1.1.0. The vulnerability exists because the escape_dict function does not properly escape dictionary keys when processing untrusted JSON input. This allows attackers to inject malicious SQL code through crafted dictionary keys, potentially leading to unauthorized data access, modification, or deletion.

Critical Impact

Applications using PyMySQL with untrusted JSON input are vulnerable to SQL injection attacks that could compromise database integrity and confidentiality.

Affected Products

• PyMySQL versions through 1.1.0
• Applications using PyMySQL with untrusted JSON input
• Python applications utilizing escape_dict for query parameterization

Discovery Timeline

• 2024-05-21 - CVE CVE-2024-36039 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-36039

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) stems from improper input validation in PyMySQL's escape_dict function. When applications process JSON data from untrusted sources and pass it to database queries, the dictionary values are properly escaped, but the dictionary keys are not. This oversight allows attackers to craft malicious JSON payloads where the keys themselves contain SQL injection payloads.

The vulnerability is exploitable over the network and requires low privileges to exploit. An attacker can achieve unauthorized read and write access to database contents, potentially leading to data exfiltration, data manipulation, or denial of service conditions depending on the application's database permissions.

Root Cause

The root cause of CVE-2024-36039 lies in the incomplete implementation of the escape_dict function within PyMySQL. While the function properly sanitizes dictionary values to prevent SQL injection, it assumes that dictionary keys are trusted and safe. This assumption breaks down when applications accept JSON input from external sources, as JSON object property names become dictionary keys that can contain arbitrary strings, including SQL injection payloads.

Attack Vector

The attack vector for this vulnerability involves sending specially crafted JSON data to an application that uses PyMySQL. When the application converts this JSON to a Python dictionary and passes it to escape_dict for query parameterization, the malicious key names are incorporated directly into SQL queries without proper escaping.

An attacker could exploit this by providing JSON input where object keys contain SQL syntax such as comment sequences, UNION statements, or other injection payloads. When these keys are interpolated into SQL queries, the injected code executes in the context of the database connection.

Detection Methods for CVE-2024-36039

Indicators of Compromise

• Unusual database queries containing SQL syntax in parameter names
• Error logs showing SQL syntax errors with unexpected characters in column or field names
• Database audit logs revealing queries with malformed parameter structures
• Application logs indicating JSON parsing followed by database errors

Detection Strategies

• Monitor application logs for SQL syntax errors that reference dictionary keys or JSON field names
• Implement database query auditing to detect queries with unusual parameter patterns
• Deploy web application firewalls (WAF) configured to detect SQL injection patterns in JSON payloads
• Review code for instances where untrusted JSON data is passed to PyMySQL queries

Monitoring Recommendations

• Enable detailed SQL query logging on database servers to capture parameterized query patterns
• Set up alerts for SQL errors indicating injection attempts in key/field positions
• Monitor network traffic for JSON payloads containing SQL-specific characters in object keys
• Implement runtime application self-protection (RASP) to detect exploitation attempts

How to Mitigate CVE-2024-36039

Immediate Actions Required

• Upgrade PyMySQL to version 1.1.1 or later immediately
• Audit all code paths where JSON input is processed and passed to database queries
• Implement input validation to whitelist allowed dictionary keys before database operations
• Consider using parameterized queries with explicit column specifications rather than dynamic key interpolation

Patch Information

The vulnerability has been addressed in PyMySQL version 1.1.1. The fix ensures that dictionary keys are properly escaped when using the escape_dict function. Organizations should upgrade to the patched version as soon as possible.

For more information, see the GitHub PyMySQL Release v1.1.1. Linux distribution users should also check the Debian LTS Advisory and Fedora package announcements for distribution-specific patches.

Workarounds

• Validate and sanitize all JSON input keys against an allowlist before processing
• Avoid passing untrusted JSON directly to database query functions
• Implement a layer of abstraction that explicitly maps expected keys to database parameters
• Use ORM frameworks that handle parameterization independently of user input structure

If upgrading is not immediately possible, applications should implement strict validation on all dictionary keys derived from external JSON input before passing them to PyMySQL functions. This can be accomplished by comparing keys against an explicit allowlist of expected parameter names.