CVE-2024-12745: 
Python vulnerability analysis and mitigation

A SQL injection vulnerability (CVE-2024-12745) was discovered in Amazon Redshift Python Connector version 2.1.4. The vulnerability allows users to gain escalated privileges through the get_schemas, get_tables, or get_columns Metadata APIs. The issue was disclosed on December 24, 2024, and affects specifically the Amazon Redshift Python Connector v2.1.4 (AWS Security Bulletin, GitHub Advisory).

The vulnerability stems from improper handling of user-supplied input in metadata API calls. The affected APIs (get_schemas, get_tables, and get_columns) were susceptible to SQL injection attacks due to insufficient input validation. The vulnerability has received a CVSS v3.1 base score of 8.0 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and high impact on confidentiality, integrity, and availability (NVD).

The vulnerability could allow malicious actors to craft specially designed input that, when processed by the vulnerable APIs, would enable them to inject their own SQL code into the queries sent to the Redshift server. This could potentially lead to unauthorized access, modification, or deletion of sensitive data with escalated privileges (Security Online).

The vulnerability requires network access and low privileges for exploitation, though user interaction is required. The attack complexity is rated as low, making it relatively straightforward for attackers to exploit if left unpatched (GitHub Advisory).

Amazon has released version 2.1.5 of the Python Connector to address this vulnerability. The patch implements enhanced security measures where all metadata command inputs are now sent to the Redshift server as part of parameterized queries, using either QUOTE_IDENT(string) or QUOTE_LITERAL(string) to properly escape user-supplied input. Users are recommended to either upgrade to version 2.1.5 or revert to the unaffected version 2.1.3 (AWS Security Bulletin).