CVE-2025-65896

Executive Summary

CVE-2025-65896 is a critical SQL injection vulnerability discovered in the assyncmy library by vendor Long2ice, affecting versions up to and including 0.2.10. The flaw allows an unauthenticated attacker to execute arbitrary SQL commands by crafting malicious dictionary keys that are passed to database queries without proper sanitization. This can lead to full database compromise, data exfiltration, and potential lateral movement within the network.

The vulnerability resides in the core query-building logic of assyncmy, where user-supplied dict keys are directly interpolated into SQL statements. Since assyncmy is a Python package (PyPI ecosystem), this poses a significant supply chain risk for any application that integrates this library for asynchronous MySQL operations.

Supply Chain & Package Security

This vulnerability affects the PyPI package assyncmy. Organizations using this library in their Python applications should immediately assess their dependency trees. The lack of an official patch means that any application relying on assyncmy <= 0.2.10 is at risk. Attackers can exploit this by injecting malicious input that reaches the vulnerable code path, potentially compromising the entire application and its data.

CVSS Breakdown & Threat Level

CVSS Score: 10.0 (Critical)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed to exploit.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The exploit cannot affect resources beyond the vulnerable component.
• Confidentiality (C): High – Full database read access is possible.
• Integrity (I): High – Database records can be modified or deleted.
• Availability (A): High – Denial of service via SQL injection is possible.

Threat Level: Critical. The combination of network exploitability, no authentication, and full impact on confidentiality, integrity, and availability makes this a top-priority vulnerability.

Deep Dive & Mechanics

The vulnerability exists in the assyncmy library's query construction mechanism. The library accepts Python dictionaries to build SQL queries dynamically. When a user-supplied dictionary is passed to functions like insert, update, or select, the keys of the dictionary are used directly in the SQL statement without proper escaping or parameterization.

For example, consider a function that constructs an INSERT statement:

async def insert(table, data):
    columns = ', '.join(data.keys())
    values = ', '.join(['%s'] * len(data))
    query = f"INSERT INTO {table} ({columns}) VALUES ({values})"
    # ... execute query with data.values()

If an attacker controls the keys of the data dictionary, they can inject arbitrary SQL. For instance, a key like "username); DROP TABLE users; --" would result in:

INSERT INTO users (username); DROP TABLE users; --) VALUES (%s)

This allows the attacker to execute arbitrary SQL commands, including data theft, modification, or deletion.

The vulnerability is particularly dangerous because:

• It does not require authentication.
• It can be triggered via any input that eventually becomes a dict key in a database operation.
• The library is used in asynchronous Python applications, often in web frameworks like FastAPI or aiohttp.

Vulnerable vs. Patched Code

Vulnerable Code (assyncmy <= 0.2.10):

# In query_builder.py or similar
def build_insert_query(table, data):
    columns = ', '.join(data.keys())
    placeholders = ', '.join(['%s'] * len(data))
    query = f"INSERT INTO {table} ({columns}) VALUES ({placeholders})"
    return query, list(data.values())

The keys are directly concatenated into the SQL string without sanitization.

Patched Code (Hypothetical fix):

# In query_builder.py (patched version)
def build_insert_query(table, data):
    # Sanitize keys: only allow alphanumeric and underscore
    sanitized_keys = [re.sub(r'[^a-zA-Z0-9_]', '', key) for key in data.keys()]
    columns = ', '.join(sanitized_keys)
    placeholders = ', '.join(['%s'] * len(data))
    query = f"INSERT INTO {table} ({columns}) VALUES ({placeholders})"
    return query, list(data.values())

The fix should validate and sanitize dict keys to ensure they contain only safe characters. Additionally, using parameterized queries for values is already in place, but the keys themselves must be hardened.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Deploy a vulnerable application using assyncmy 0.2.10 (e.g., a FastAPI app with an endpoint that accepts JSON and inserts into a database).
2. Install assyncmy via pip: pip install assyncmy==0.2.10
3. Set up a MySQL/MariaDB database.

Exploitation Steps:

1. Identify an endpoint that accepts user input and passes it as a dict to assyncmy functions.
2. Craft a malicious JSON payload where the keys contain SQL injection payloads.

Example payload for an INSERT endpoint:

{
  "username": "test",
  "password": "test",
  "email); DROP TABLE users; --": "injected"
}

3. Send the request. The resulting SQL query becomes:

INSERT INTO users (username, password, email); DROP TABLE users; --) VALUES (%s, %s, %s)

4. The DROP TABLE users; command executes, deleting the users table.

Advanced Exploitation:

• Use time-based blind SQL injection to extract data.
• Use UNION-based injection to retrieve arbitrary data.
• Leverage stacked queries (if supported) for more complex attacks.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual SQL queries containing unexpected characters in column names.
• Look for HTTP requests with JSON keys containing SQL keywords (e.g., DROP, UNION, SELECT).
• Use WAF rules to block requests with suspicious dict keys.

Defense:

• Immediately upgrade assyncmy if a patched version becomes available.
• Implement input validation on all user-supplied dict keys.
• Use a Web Application Firewall (WAF) with SQL injection signatures.
• Apply the principle of least privilege to database accounts used by the application.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests with JSON bodies containing SQL keywords in key names.
• Unusual SQL queries in database logs with unexpected column names.
• Outbound database connections from the application server to unknown IPs.

File IOCs:

• Modified database tables or unexpected schema changes.
• Presence of assyncmy version 0.2.10 or earlier in Python dependencies.

Log IOCs:

• Database error logs showing syntax errors near unexpected characters.
• Application logs showing failed SQL queries with injected content.

Detection Engineering

YARA Rule

rule Detect_Assyncmy_SQLi_Keys {
    meta:
        description = "Detects malicious dict keys used in assyncmy SQL injection"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65896"
    strings:
        $sql_keyword1 = /["'][a-zA-Z0-9_]*\s*(DROP|UNION|SELECT|INSERT|UPDATE|DELETE|ALTER|CREATE|EXEC|OR|AND)\s/i
        $sql_keyword2 = /["'][a-zA-Z0-9_]*\s*--/
        $sql_keyword3 = /["'][a-zA-Z0-9_]*\s*;/
    condition:
        any of them
}

Sigma Rule

title: Detect SQL Injection via Dict Keys in assyncmy
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with JSON keys containing SQL injection patterns targeting assyncmy
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.method: POST
        http.content_type: application/json
        http.body|contains|all:
            - 'DROP'
            - 'UNION'
            - 'SELECT'
            - 'INSERT'
            - 'UPDATE'
            - 'DELETE'
            - 'ALTER'
            - 'CREATE'
            - 'EXEC'
            - 'OR'
            - 'AND'
            - '--'
            - ';'
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in non-SQL contexts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-65896 - assyncmy SQL Injection via Dict Keys"; flow:to_server,established; content:"POST"; http_method; content:"application/json"; http_client_body; pcre:"/["'][a-zA-Z0-9_]*\s*(DROP|UNION|SELECT|INSERT|UPDATE|DELETE|ALTER|CREATE|EXEC|OR|AND)\s/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate any systems running assyncmy <= 0.2.10 from untrusted networks.
2. Audit all code that uses assyncmy to identify potential injection points.
3. Implement input validation on all dict keys before passing them to assyncmy functions.

Long-term Fix:

• The vendor (Long2ice) must release a patched version that sanitizes dict keys.
• Until then, consider replacing assyncmy with an alternative library (e.g., aiomysql with proper parameterization).

Compensating Controls:

• Deploy a WAF with custom rules to block SQL injection attempts.
• Use database activity monitoring to detect anomalous queries.
• Apply strict least-privilege database permissions.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For further analysis or incident response assistance, contact your Valters IT representative.