Open Redirect Vulnerability in Django
Summary
CVE-2017-7233: Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. Affects py-django across 39 version ranges.
< 1.10.7-r0
< 4c047e90b62529681dc691bc935036108d6b0324
< 6e749c21e77dc74af068c8e943a6e6850ae0bb24
< 8a2a3a63b83375d9322c077b6356007e0bef5939
< 8dd33d429892fc06cc9aa655012491f029f5f491
< 9fbdc48c493f43961173bab8f23d633ab41a9608
< 25e416ca0f3ea6035c8d797dcc9604bc32202268
< 46b40274dd44921f72a59771ecb3d2b2c7b3aa0b
< 52db0d5742777a77717df5b1e85d056910a2515d
< 56b3416939ca921cac54b6c79e1b445cbff34098
< 80b7e9d09f2d23209b591288f9b2cf3eb3d927c8
< 320ec4ed27c254a87e09a70601b1b27ae0a0456e
< 448fcd66e6ffce0d000d38a07e6d61823fa14107
< 449d1effb81152e54f482784cf7febe965007096
< 2234d1f08d079a3e4be4f1a89847dc294a4a5c1a
< 4022b2c306e88a4ab7f80507e736ce7ac7d01186
< 4217f1cdeb070707e54fec8221b9e63e3957ef38
< 6157cd6da1b27716e8f3d1ed692a6e33d970ae46
< 82533e31c2525d9b1a77fc804330e925e8f109f0
< 37935743edbf60201adb1b53b56b8cafa754c69a
< a1f5bafac51f973cc7219d3b7c96587fe7066920
< a98e00f06834e5fdc945c2aca2c3498efb06ac7d
< aa10ba096169dcbd3e47303f6b6de59acfe883c1
< acc3c1df8474f424b2f179bac03d0e9a6bc9aba0
< b35adb0909b25a7dafc9212ddedfbf9b29dc05b8
< b29316c54bb3465265ff931e807229f13349457d
< bd97496d07466f3a940e2fcc114b540ca01cd340
< c00335997744196738368f46c30ef2eeaa0ac849
< c168aeba175dbb92c615460a360cb1ea978de5d3
< c982190acf7bcfba5e78a7505a45774916865569
< d3d12fc11da56e4ea8af37a22a9a0aa6579ab2d5
< dafddb6b8c0eb778072bec1ccd536bafad0eb936
< e3c9412d86c3c394e2604e63f3b51c102ae3e3d7
< e8bb7464c562388da48bca04c5996fe16a0c3619
< e70a309c428cfd4e600dc9fa0c7269b1e7a8efcd
< e99ebfcc140a5f794e259994f9252cb440459143
< e403f2217e67301526a0df5ea5be42e190e00e10
< ef08d8cf9e0d1ca62c6c291575d9e306cb09afcb
< f49602ad46b447c5a27d47b0e89b3440109211a4
Fixed in 1.10.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular web framework for building Python-based applications. It provides a robust set of tools and features for developing secure and scalable web applications. However, Django versions 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 are vulnerable to an open redirect vulnerability. This vulnerability arises from the reliance on user input to redirect users to an 'on success' URL. The security check for these redirects, specifically the 'django.utils.http.is_safe_url()' function, incorrectly considers some numeric URLs as safe, leading to the open redirect vulnerability. Additionally, if developers use 'is_safe_url()' to provide safe redirect targets and include such URLs in links, they may be susceptible to cross-site scripting (XSS) attacks.
Vulnerability Detail
The open redirect vulnerability in Django allows attackers to manipulate the redirect URL and potentially redirect users to malicious websites. This can be exploited to trick users into visiting phishing sites or executing unintended actions. The vulnerability arises from the incorrect validation of numeric URLs as safe, which can be abused by attackers to craft malicious URLs. Furthermore, if developers rely on the 'is_safe_url()' function to ensure safe redirect targets and include user-generated URLs in links, they may inadvertently introduce XSS vulnerabilities.
How To Fix
Minimum fixed version
1.10.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade py-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can manually validate and sanitize user-generated URLs before using them in redirects. This involves implementing custom validation logic to ensure that the URL is safe and does not contain any malicious components. It is crucial to thoroughly validate and sanitize user input to prevent open redirect vulnerabilities and XSS attacks.
Conclusion
The open redirect vulnerability in Django versions 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 can lead to potential security risks, including phishing attacks and cross-site scripting (XSS) vulnerabilities. It is crucial for developers to upgrade their Django installation to the latest patched version and implement proper input validation and sanitization to mitigate the risk of exploitation. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for py-django →
FAQ
An open redirect vulnerability occurs when a web application allows user-controlled input to be used in redirect URLs without proper validation. Attackers can manipulate the redirect URL to redirect users to malicious websites.
Attackers can exploit the open redirect vulnerability in Django by crafting malicious URLs that appear legitimate. When users click on these URLs, they are redirected to the attacker's desired location, which can be a phishing site or a site hosting malware.
The impact of the open redirect vulnerability in Django can vary depending on the attacker's intentions. It can be used to trick users into visiting malicious websites, leading to potential data theft, malware infections, or other malicious activities.
Developers should update their Django installation to the latest patched version that addresses the open redirect vulnerability. Additionally, they should implement proper input validation and sanitization to prevent the inclusion of malicious URLs in redirects.
Yes, you can use Vulert's vulnerability monitoring tool to check if your Django application is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in software.
Related vulnerabilities
Recent vulnerabilities recorded for py-django.
