CVE-2023-41328

Frappe Framework SQL Injection Vulnerability

• CVSS 7.5
• CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
• Input Validation and Sanitization
• Remote

Frappe is a low code web framework written in Python and Javascript. A SQL Injection vulnerability has been identified in the Frappe Framework which could allow a malicious actor to access sensitive information. This issue has been addressed in versions 13.46.1 and 14.20.0. Users are advised to upgrade. There's no workaround to fix this without upgrading.

CVE

CVE-2023-41328

CWE

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSS base score

7.5

Published

2023-09-06

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

SQL Injection

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update to Frappe Framework version 13.46.1 or 14.20.0.

import frappe

def get_user_data(user_id):
    # VULNERABLE: This code is susceptible to sql injection
    query = "SELECT * FROM `tabUser ` WHERE id = '{}'".format(user_id)
    user_data = frappe.db.sql(query, as_dict=True)
    
    return user_data

import frappe

def get_user_data(user_id):
    # SECURE: This version prevents sql injection
    
    query = "SELECT * FROM `tabUser ` WHERE id = %s"
    user_data = frappe.db.sql(query, (user_id,), as_dict=True)
    
    return user_data

@misc{vaitp:cve202341328,
  title        = {{Frappe Framework SQL Injection Vulnerability}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-41328},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-41328/}}
}