CVE-2019-14234

SQL Injection in Django

Title source: GitHub Advisory
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

EIP currently links 2 repository PoCs and 1 lab environment to CVE-2019-14234.

Description

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
2
Lab environments
1

Affected products and versions

1
ProductSourceVersion range

Django

Browse PyPI / Django
GitHub Advisory1.11a1 to < 1.11.23 · Fixed in 1.11.23affected
2.1a1 to < 2.1.11 · Fixed in 2.1.11affected
2.2a1 to < 2.2.4 · Fixed in 2.2.4affected

Proofs of concept

2

Repository PoCs

GitHubRivaill/CVE_2019_14234Repository PoCby Rivaill13Not analyzed30 files

18.2 KiB

GitHub
PoC details
GitHubmalvika-thakur/CVE-2019-14234Repository PoCby malvika-thakur2Not analyzed14 files

8.6 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

docker-compose.yml

malvika-thakur/CVE-2019-14234Created Vuln labCVE-2019-14234Compose · mixed

1 Compose manifest · 1 Dockerfile · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment with a Django 2.2.3 web application and a PostgreSQL 9.6 database, designed to demonstrate CVE-2019-14234, a SQL injection vulnerability in Django's JSONField/HStoreField.

README.md:1-3docker-compose.yml:1-13Dockerfile:1-11

Lab assessment

Vulnerability lab

The README explicitly states the purpose is to exploit CVE-2019-14234, a SQL injection vulnerability in Django. The environment includes a vulnerable Django 2.2.3 application with JSONField, a PostgreSQL database, and step-by-step reproduction instructions.

README.md:1-3README.md:15-32
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

web

vulnerable Django 2.2.3 applicationexploit target

A Django 2.2.3 web application built from the local Dockerfile, exposing port 8000. It uses a PostgreSQL database and includes a 'vuln' app with a Collection model that uses JSONField, which is vulnerable to SQL injection. The entrypoint script initializes the database and creates a superuser.

docker-compose.yml:3-8Dockerfile:1-11docker-entrypoint.sh:1-12models.py:1-10

db

PostgreSQL database

A PostgreSQL 9.6 Alpine database service with a database named 'cve' and password 'postgres', used as the backend for the Django application.

docker-compose.yml:9-13settings.py:78-86
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2019-14234

Supported by supplied evidence

The README describes the vulnerability as a SQL injection in Django's JSONField/HStoreField, and the environment includes a Django 2.2.3 application with a JSONField model. The reproduction steps show injecting a single quote via the 'detail' JSONField parameter, causing a SQL error, which aligns with the CVE description.

README.md:1-3README.md:24-32models.py:5-6
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the environment.README.md:15-18
  • The web service depends on the db service, which must be started first.docker-compose.yml:6-7
  • The Django application requires a PostgreSQL database with specific credentials and database name.settings.py:78-86

Evidence-described exercise path

  1. Build and start the environment using 'docker compose build' and 'docker compose up -d'.README.md:15-18
  2. Access the Django home page at http://your-ip:8000.README.md:20
  3. Log in to Django admin at http://your-ip:8000/admin/ with username 'admin' and password 'a123123123'.README.md:23
  4. Navigate to the Collection model list view at http://your-ip:8000/admin/vuln/collection/.README.md:25
  5. Add the GET parameter 'detail__a'b=123' to the URL to trigger a SQL injection error.README.md:27-32
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the contained lab environment. The web service exposes port 8000, which is necessary for accessing the vulnerable application. The entrypoint script initializes the database and creates a superuser, which is required for the exercise. No evidence of host escape, external connections, persistence, credential theft, or destructive behavior beyond the lab target.

docker-compose.yml:5docker-entrypoint.sh:7-9Dockerfile:10
Review boundaries

What the analysis did not establish

  • The packet does not include the contents of the 'src/' directory copied into the Docker image, so the full Django project code (beyond the provided settings, models, etc.) is not visible.
  • The 'collection.json' fixture file is referenced in the entrypoint but its contents are not provided in the evidence files.
  • The base image 'vulhub/django:2.2.3' is not inspected; its contents are unknown.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

Showing 12 of 17