Vulnerability in Django: Incorrect Filesystem Cache Permissions
Summary
CVE-2020-24584: An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). Affects py-django across 2 version ranges.
< 1.11.29-r1
>= 635d53a86a36cde7866b9caefeb64d809e6bfcd9, < bf07047f45767eddaf52400c60f7e2becc8891d3
Fixed in 1.11.29-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular web framework written in Python that enables developers to build web applications quickly and efficiently. It provides a wide range of features and tools for handling various aspects of web development. However, a vulnerability has been discovered in Django versions 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). This vulnerability affects the intermediate-level directories of the filesystem cache, which have incorrect permissions. Instead of having the appropriate permissions set, they inherit the system's standard umask.
Vulnerability Detail
The vulnerability (CVE-2020-24584) in Django allows an attacker to access sensitive information stored in the filesystem cache. By exploiting the incorrect permissions, an attacker can potentially read or modify cached data that should be protected. This could lead to unauthorized access, data leakage, or even the execution of arbitrary code. The vulnerability primarily affects Django applications running on systems with Python 3.7 or higher.
How To Fix
Minimum fixed version
1.11.29-r1
This is the first release that contains the fix.
sudo apk add --upgrade py-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround can be implemented by manually setting the correct permissions for the intermediate-level directories of the filesystem cache. This can be done by modifying the umask value in the Django settings file to 0o077. However, this workaround should only be considered as a temporary solution, and upgrading to the fixed versions of Django is strongly recommended.
Conclusion
The vulnerability in Django's filesystem cache permissions can lead to unauthorized access and data leakage. It is crucial to upgrade to the fixed versions of Django (2.2.16, 3.0.10, or 3.1.1) to mitigate this vulnerability. If immediate upgrade is not possible, applying the temporary workaround of manually setting the correct permissions is recommended. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for py-django →
FAQ
This vulnerability allows an attacker to access sensitive information stored in the filesystem cache, potentially leading to unauthorized access, data leakage, or arbitrary code execution.
Django versions 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used) are affected by this vulnerability.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to apply the necessary fixes to prevent any potential exploitation.
A temporary workaround is available by manually setting the correct permissions for the filesystem cache directories. However, upgrading to the fixed versions of Django is the recommended long-term solution.
More information about this vulnerability can be found in the official CVE-2020-24584 advisory and the Django project's security announcements.
Related vulnerabilities
Recent vulnerabilities recorded for py-django.
