Cross-Site Scripting Vulnerability in Django - py-django and py3-django
Summary
ALPINE-CVE-2017-12794: In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Affects py-django versions < 1.11.5-r0. Fixed in 1.11.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, authentication, and templating. The affected packages, py-django and py3-django, are the Python bindings for Django, which are essential for integrating Django into Alpine Linux environments. This vulnerability affects versions of Django prior to 1.11.5 and can lead to security issues if not addressed.
Vulnerability Detail
In Django versions 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled on the technical 500 debug page. This flaw can be exploited under certain conditions to execute cross-site scripting (XSS) attacks, potentially allowing attackers to inject malicious scripts into web pages viewed by users. Although this vulnerability is primarily a concern during development (when DEBUG mode is enabled), it poses risks if mistakenly left active in production environments.
How To Fix
Minimum fixed version
1.11.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade py-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling DEBUG mode in your Django settings to prevent access to the vulnerable debug page. Set DEBUG = False in your settings.py file:
Conclusion
The vulnerability in Django's debug page poses a significant risk if not addressed, particularly in environments where DEBUG mode is enabled. Updating to the latest patched versions of py-django and py3-django is essential to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for py-django →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a medium severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package, ensure that DEBUG mode is turned off in your production settings to minimize exposure to this vulnerability.
This vulnerability is less likely to affect most production sites since running with DEBUG = True is not recommended in production settings.
If exploited, this vulnerability could allow attackers to execute scripts in the context of a user's browser, leading to data theft, session hijacking, or other malicious actions.
References
Related vulnerabilities
Recent vulnerabilities recorded for py-django.
