CVE-2024-53908

What it actually does

Direct use of django.db.models.fields.json.HasKey lookup against Oracle allows SQL injection when untrusted data is supplied as the lhs value, enabling arbitrary SQL execution.

Why it matters to the business

Attackers may read, modify, or delete database contents, leading to data breaches, compliance violations, and service disruption; urgency is moderate given low EPSS and absence from known exploited lists despite high CVSS.

How an attack unfolds

An attacker supplies a malicious string as the left-hand side value to a direct HasKey lookup in an ORM query running against Oracle; the unsanitized input is concatenated into the generated SQL statement, allowing injection of additional clauses or commands.

How to fix it

Upgrade Django to 5.1.4+, 5.0.10+, or 4.2.17+; the patch is present in commit 3b3a5f4efbf93692557b7f473519bd0ad8f04c6a. Avoid direct HasKey usage with untrusted lhs values on Oracle until patched.

How to confirm the fix worked

Confirm Django version is at or above the fixed releases, review ORM queries for direct HasKey calls, and test affected lookups against an Oracle backend with both benign and attempted injection inputs.

Typical attack path

1. Identify application code paths that invoke HasKey directly with user-controlled data
2. Craft input containing SQL metacharacters or subqueries targeting Oracle syntax
3. Submit the payload through the affected request or API endpoint
4. Observe database error responses or extracted data to confirm and escalate the injection

How to detect it

Search application and database logs for queries containing HasKey with unusual lhs values or Oracle-specific error patterns indicating malformed JSON path expressions; review audit trails for unexpected data access following ORM calls.

What your security team should do

• Immediately inventory Django deployments using Oracle and direct HasKey lookups
• Apply the listed patch releases or commit within the next sprint
• Add static analysis or code review rules to flag direct HasKey usage
• Monitor EPSS and KEV updates for any rise in exploitation activity