PyAthena SQL Injection Vulnerability: Early Warning Issued
An early warning has been issued for a critical SQL injection vulnerability in PyAthena versions prior to 3.35.4, potentially allowing unauthenticated attackers to execute arbitrary SQL.
What happened
PyAthena versions prior to 3.35.4 reportedly contain a SQL injection vulnerability that enables unauthenticated attackers to inject arbitrary SQL. This vulnerability appears to arise from improper quote-escaping in DefaultParameterFormatter.format(), which routes DELETE and CTAS statements to the _escape_hive function. This function backslash-escapes single quotes instead of doubling them, allowing attacker-supplied input to terminate string literals prematurely. This could enable data exfiltration via UNION SELECT, execution of destructive statements, and attacker-controlled CTAS destination and content.
The vulnerability is under investigation and has been assigned a CVSS score of 9.8, indicating critical severity. To mitigate potential exposure, it is recommended to upgrade to PyAthena version 3.35.4 or later. For more detailed information, consult the primary sources linked in the threat data.
How 0Day mitigates this
pyathena is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.