CVE-2024-42005: Django JSONField SQL Injection Vulnerability

CVE-2024-42005 Overview

CVE-2024-42005 is a SQL Injection vulnerability discovered in Django, the popular Python web framework. The vulnerability affects Django versions 5.0 before 5.0.8 and 4.2 before 4.2.15. The flaw exists in the QuerySet.values() and values_list() methods when used on models containing a JSONField. Attackers can exploit this vulnerability by crafting malicious JSON object keys that are passed as *arg parameters, enabling SQL injection through column aliases.

Critical Impact

This SQL injection vulnerability allows unauthenticated attackers to potentially execute arbitrary SQL commands against the database, leading to data exfiltration, data manipulation, or denial of service conditions in affected Django applications.

Affected Products

• Django 5.0 before 5.0.8
• Django 4.2 before 4.2.15
• Applications using QuerySet.values() or values_list() with JSONField models

Discovery Timeline

• 2024-08-06 - Django Project releases security patch
• 2024-08-07 - CVE-2024-42005 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2024-42005

Vulnerability Analysis

This vulnerability is classified as CWE-89 (SQL Injection) and affects Django's Object-Relational Mapping (ORM) layer. The issue arises from improper sanitization of JSON object keys when they are used as column aliases in SQL queries generated by the values() and values_list() methods.

When a Django model includes a JSONField and developers use QuerySet.values() or values_list() with dynamically provided arguments, the framework fails to properly escape or validate JSON object keys before incorporating them into the generated SQL query. This allows attackers to break out of the intended column alias context and inject arbitrary SQL code.

The vulnerability is particularly concerning because it can be triggered through network-accessible input, requires no authentication, and affects multiple aspects of the application including confidentiality, integrity, and availability of the data.

Root Cause

The root cause of CVE-2024-42005 lies in insufficient input validation within Django's query construction logic. When processing JSON object keys as column aliases in the values() and values_list() methods, the framework does not adequately sanitize special characters or enforce proper escaping. This oversight allows crafted JSON keys containing SQL metacharacters to be directly interpolated into the generated SQL query string, breaking the intended query structure and enabling injection attacks.

Attack Vector

The attack vector for this vulnerability is network-based. An attacker can exploit this flaw by sending specially crafted HTTP requests to a Django application that:

1. Uses a model with a JSONField
2. Accepts user-controlled input that influences arguments passed to values() or values_list() methods
3. Does not implement additional input sanitization before ORM operations

The malicious payload is embedded within a JSON object key, which when processed by the vulnerable methods, injects SQL commands into the column alias portion of the query. This can allow attackers to extract sensitive data, modify database contents, or cause denial of service through resource-intensive queries.

The vulnerability mechanism can be understood as follows: when a QuerySet operation like values() receives a JSONField key path as an argument, that key path is used to construct part of the SQL query. If the key contains unescaped SQL syntax, it will be interpreted as part of the query rather than as a literal string value. For detailed technical information, refer to the Django Security Release Notes.

Detection Methods for CVE-2024-42005

Indicators of Compromise

• Unusual or malformed JSON keys in application logs containing SQL syntax such as single quotes, semicolons, or SQL keywords
• Database query logs showing unexpected column aliases or additional SQL clauses
• Error messages indicating SQL syntax errors originating from JSONField-related queries
• Anomalous database access patterns or data exfiltration attempts

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in JSON payloads
• Monitor application logs for requests containing suspicious JSON object keys with SQL metacharacters
• Enable database query logging and alert on queries with unexpected structure or syntax
• Deploy runtime application self-protection (RASP) solutions to detect injection attempts at the application layer

Monitoring Recommendations

• Configure alerts for database errors related to malformed queries from Django ORM operations
• Monitor for unusual data access patterns that may indicate successful exploitation
• Review access logs for repeated requests targeting endpoints that use values() or values_list() with JSONField models
• Implement anomaly detection for database query patterns to identify injection attempts

How to Mitigate CVE-2024-42005

Immediate Actions Required

• Upgrade Django to version 5.0.8 or later for Django 5.0.x installations
• Upgrade Django to version 4.2.15 or later for Django 4.2.x installations
• Audit application code for usage of values() and values_list() methods with user-controlled arguments on JSONField models
• Implement input validation to sanitize any user-provided data used in ORM query construction

Patch Information

Django has released security patches addressing this vulnerability. The fixed versions are Django 5.0.8 and Django 4.2.15. Organizations should upgrade to these versions immediately. Detailed information about the security release is available from the Django Weblog Security Release and the Django Security Release Notes. Additionally, NetApp has published a related advisory at NetApp Security Advisory NTAP-20240905-0007.

Workarounds

• Avoid passing user-controlled input directly to values() or values_list() method arguments
• Implement strict allowlisting for any field names or JSON keys accepted from user input
• Add application-level input validation to reject JSON keys containing SQL metacharacters
• Consider using parameterized queries or raw SQL with proper escaping for complex JSONField operations until patches can be applied

# Upgrade Django to patched version
pip install --upgrade Django>=5.0.8  # For Django 5.0.x
# or
pip install --upgrade Django>=4.2.15  # For Django 4.2.x

# Verify installed version
python -c "import django; print(django.VERSION)"