CVE-2020-24584: Django Filesystem Cache Umask Vulnerability
Summary
CVE-2020-24584: An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). Affects django across 3 version ranges.
>= 2.2.0, < 2.2.16
>= 3.0.0, < 3.0.10
>= 3.1.0, < 3.1.1
Fixed in 2.2.16, 3.0.10 or 3.1.1, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2020-24584 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular open-source web framework written in Python. It provides a set of tools and libraries for building web applications quickly and efficiently. The filesystem cache is a feature in Django that allows temporary storage of rendered templates and other processed data to improve performance. This vulnerability affects Django versions 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 when Python 3.7+ is used.
Vulnerability Detail
The vulnerability arises from the fact that the intermediate-level directories of the filesystem cache in affected Django versions have the system's standard umask rather than 0o077. This means that the permissions set on these directories may be more permissive than intended, potentially allowing unauthorized access to sensitive cached data. An attacker with access to the filesystem cache could read or modify cached data belonging to other users or applications, leading to information disclosure or even remote code execution.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.2.0, < 2.2.162.2.16 -
>= 3.0.0, < 3.0.103.0.10 -
>= 3.1.0, < 3.1.13.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround can be implemented by manually setting the umask to 0o077 before starting the Django server. This can be achieved by adding the following line of code to the server startup script:
import os os.umask(0o077)
Conclusion
In conclusion, the Django Filesystem Cache Umask Vulnerability (CVE-2020-24584) affects certain versions of Django and can potentially lead to unauthorized access and information disclosure. It is crucial to upgrade to the fixed versions or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability allows unauthorized access to sensitive cached data, potentially leading to information disclosure or remote code execution.
Django versions 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used) are affected.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the tool will provide real-time alerts for open-source vulnerabilities.
Yes, upgrading Django to version 2.2.16, 3.0.10, or 3.1.1 will fix this vulnerability.
Yes, a temporary workaround is to manually set the umask to 0o077 before starting the Django server.
Related vulnerabilities
Recent vulnerabilities recorded for django.
