GHSA-ccg5-9c8w-xh6v: Input Validation
Summary
ModelView.sortquery() uses the attacker-controlled sortBy list-view query parameter without checking it against the configured columnsortablelist allow-list. The value is resolved with getattr(model, ...) and fed into relationship joins and orderby(), so a request can sort by any column of the model — including ones hidden from columnlist — and, via a dotted path, by columns of related models. Because row order then reflects the value of an unexposed column, this is an information-exposure ordering oracle.
Root cause
columnsortablelist is consulted only in the list template to decide which header links to render; the server never enforces it, so removing a column from the UI does not prevent sorting by it.
Exploitation
A single request leaks the relative ordering of an unexposed column; the asc↔desc reversal confirms rows are ordered by the secret's actual value. Pairing sortBy with searchable/filterable columns and pagination can narrow the oracle toward specific values, though value recovery is conditional on having a filterable target column.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/sqladminto a version that resolves this vulnerability.Fixed in 0.27.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using SQLAdmin list views are exposed when the view is reachable by an attacker and the underlying model or related models contain columns that are not intended to be sortable or visible. The issue can expose relative ordering of hidden model columns, including columns reached through dotted relationship paths.
Does removing a column from the list view or sortable-header UI prevent exploitation?
No. The configured column_sortable_list is used only to decide which sort links appear in the template; the server does not enforce that allow-list for the sortBy query parameter.
What does an attacker need to exploit it?
An attacker can send a request with an arbitrary sortBy value and does not need privileges or user interaction according to the supplied severity vector. A single request can reveal relative ordering, while combining sorting with searchable or filterable columns and pagination can narrow the oracle when a target column is filterable.
How can defenders check whether their deployment is affected?
Test whether a list-view request accepts sortBy values for columns absent from column_sortable_list or column_list, including dotted paths to related-model columns. If changing asc to desc reverses row order for such a field, the ordering oracle is present.