CVE-2021-31542: Directory Traversal Vulnerability in Django
Summary
CVE-2021-31542: In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names. Affects django across 3 version ranges.
>= 2.2.0, < 2.2.21
>= 3.1.0, < 3.1.9
>= 3.2.0, < 3.2.1
Fixed in 2.2.21, 3.1.9 or 3.2.1, depending on the release line you run. How to fix ↓
Also tracked for
- django · PyPI
- python-django · Debian:11
- django · PyPI
The same CVE-2021-31542 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular open-source web framework written in Python. It provides a robust set of tools and features for building web applications. This vulnerability affects Django versions 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1. The MultiPartParser, UploadedFile, and FieldFile components of Django allow directory traversal through uploaded files with specially crafted file names.
Vulnerability Detail
The directory traversal vulnerability in Django allows an attacker to bypass file upload restrictions and access files outside of the intended directory. By manipulating the file name during the upload process, an attacker can traverse the file system and potentially access sensitive files. This could lead to unauthorized disclosure of sensitive information or even remote code execution if the uploaded file is executed by the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.2.0, < 2.2.212.2.21 -
>= 3.1.0, < 3.1.93.1.9 -
>= 3.2.0, < 3.2.13.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround is to implement additional validation checks on the file names during the upload process. This can be done by enforcing strict naming conventions, disallowing special characters or sequences that could be used for directory traversal. Here is an example of how to implement such validation in Python:
import os
def validate_file_name(file_name):
# Check for any suspicious characters or sequences
if '../' in file_name:
raise ValueError('Invalid file name')
# Additional checks and validation logic
...
# Usage example
file_name = request.FILES['file'].name
validate_file_name(file_name)
Conclusion
The directory traversal vulnerability in Django can be mitigated by upgrading to the fixed versions or implementing additional validation checks. It is crucial to promptly address this vulnerability to prevent unauthorized access to sensitive files. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability allows an attacker to access files outside of the intended directory, potentially leading to unauthorized disclosure of sensitive information or remote code execution.
No, only Django versions 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1 are affected. It is recommended to upgrade to the fixed versions.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for vulnerabilities in real-time.
Yes, patches have been released in Django versions 2.2.21, 3.1.9, and 3.2.1. It is recommended to upgrade to one of these versions to fix the vulnerability.
Yes, you can implement additional validation checks on the file names during the upload process to mitigate the risk. The provided workaround section explains how to implement this validation.
Related vulnerabilities
Recent vulnerabilities recorded for django.
