Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query execution

The impact of this vulnerability is severe. An attacker can leverage SQL Injection to bypass authentication and authorization controls, gaining unauthorized access to sensitive data stored within the database. This could include user credentials, financial information, or other confidential data. Depending on the database schema and permissions, an attacker might also be able to modify or delete data, or even execute operating system commands on the database server. The lack of authentication required to exploit this vulnerability significantly broadens the attack surface.

Applications and systems utilizing SQLAlchemyDA versions 2.2 and earlier are at risk. This includes Python applications that rely on SQLAlchemyDA for database interactions, particularly those handling sensitive data or operating in environments with limited security controls. Any system where SQLAlchemyDA is used without proper input validation is potentially vulnerable.

• python / server:

import sqlalchemy
import os

def check_sqlalchemyda_version():
    try:
        import sqlalchemy_utils
        version = sqlalchemy_utils.__version__
        print(f"SQLAlchemyDA version: {version}")
        if version <= '2.2':
            print("VULNERABLE: Upgrade to version 2.3 or later.")
        else:
            print("Not vulnerable.")
    except ImportError:
        print("SQLAlchemyDA not installed.")

check_sqlalchemyda_version()

1. 2024-02-07Disclosure

   disclosure

1. आरक्षित2024-01-31
2. प्रकाशित2024-02-07
3. संशोधित2025-05-15
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-24811 is to immediately upgrade to SQLAlchemyDA version 2.2 or later. Since there is no workaround, relying on other security measures is insufficient. Consider implementing strict database access controls and limiting database user privileges to minimize potential damage if the vulnerability is exploited before patching. Regularly review database activity logs for suspicious queries.