CVE-2017-20172 (published 2023-01-18T15:15Z)

A vulnerability was found in ridhoq soundslike. It has been classified as critical. Affected is the function get_song_relations of the file app/api/songs.py. The manipulation leads to sql injection. The patch is identified as 90bb4fb667d9253d497b619b9adaac83bf0ce0f8. It is recommended to apply a patch to fix this issue. VDB-218490 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/ridhoq/soundslike
commit_details: repo_url: https://github.com/ridhoq/soundslike
author: Ridwan Hoq
author_date: 2017-03-17 15:56:52-05:00
msg: fix sql injection vulnerability in get_song_relations 😅
repository: repo_url: https://github.com/ridhoq/soundslike
repo_name: ridhoq/soundslike
description: soundslike app written in flask + react
repo_language: JavaScript
owner: ridhoq
file_changes: filename: songs.py
change_type: ModificationType.MODIFY
diff: @@ -62,7 +62,11 @@ def new_song():
 
 @api.route('/songs/<int:id>/related')
 def get_song_relations(id):
-    top = request.args.get('top')
+    top_str = request.args.get('top')
+    if not top_str.isdigit() or not int(top_str) > 0:
+        message = 'top query param must be an int greater than 0'
+        return bad_request(message)
+    top = int(request.args.get('top'))
     song = Song.query.filter_by(id=id).first()
     if not song:
         return route_not_found(song)

programming_language: Python
filename: test_song_relations.py
change_type: ModificationType.MODIFY
diff: @@ -331,3 +331,22 @@ class TestSongRelationsApi():
         assert len(res.json) == 1
         assert res.json[0]['id'] == self.songs['edm'][1]['id']
 
+    def test_get_song_relations_top_query_param(self):
+        song_id = self.songs['edm'][0]['id']
+        res = self.client.get(url_for('api.get_song_relations', id=song_id, top=0),
+                              content_type='application/json')
+        assert res.status_code == 400
+        assert res.json['error'] == 'bad request'
+        assert res.json['message'] == 'top query param must be an int greater than 0'
+
+        res = self.client.get(url_for('api.get_song_relations', id=song_id, top=-1),
+                              content_type='application/json')
+        assert res.status_code == 400
+        assert res.json['error'] == 'bad request'
+        assert res.json['message'] == 'top query param must be an int greater than 0'
+
+        res = self.client.get(url_for('api.get_song_relations', id=song_id, top='10; select * from users'),
+                              content_type='application/json')
+        assert res.status_code == 400
+        assert res.json['error'] == 'bad request'
+        assert res.json['message'] == 'top query param must be an int greater than 0'

programming_language: Python