CVE-2021-3281: Django - Directory Traversal Vulnerability
Summary
CVE-2021-3281: In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with a... Affects django across 3 version ranges.
>= 2.2.0, < 2.2.18
>= 3.0.0, < 3.0.12
>= 3.1.0, < 3.1.6
Fixed in 2.2.18, 3.0.12 or 3.1.6, depending on the release line you run. How to fix ↓
Also tracked for
- django · PyPI
- django · PyPI
- python-django · Debian:11
- django · PyPI
The same CVE-2021-3281 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular open-source web framework written in Python. It provides a set of tools and libraries for building web applications quickly and efficiently. Django is widely used in various industries and is known for its robustness and security. However, a vulnerability has been discovered in versions 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6 of Django.
Vulnerability Detail
The vulnerability, identified as CVE-2021-3281, allows for directory traversal attacks through the 'django.utils.archive.extract' method. This method is used by the 'startapp --template' and 'startproject --template' commands. An attacker can exploit this vulnerability by providing an archive file with absolute paths or relative paths containing dot segments. This can lead to unauthorized access to files and directories outside the intended scope of the application. The impact of this vulnerability can vary depending on the specific application and its configuration.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.2.0, < 2.2.182.2.18 -
>= 3.0.0, < 3.0.123.0.12 -
>= 3.1.0, < 3.1.63.1.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround is to avoid using the 'startapp --template' and 'startproject --template' commands. Instead, manually create the necessary files and directories for new Django projects or apps. This eliminates the use of the vulnerable 'django.utils.archive.extract' method and reduces the risk of directory traversal attacks.
Conclusion
In conclusion, the directory traversal vulnerability in Django versions 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6 can potentially expose sensitive files and directories to unauthorized access. It is crucial to upgrade Django to the patched versions or apply the provided workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
Directory traversal, also known as path traversal, is a web security vulnerability that allows an attacker to access files and directories outside the intended scope of an application. It occurs when insufficient input validation is performed on user-supplied file paths.
The impact of this vulnerability can vary depending on the specific application and its configuration. In some cases, it can lead to unauthorized access to sensitive files or directories, potentially exposing sensitive information or allowing an attacker to execute arbitrary code.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for any open-source vulnerabilities, including CVE-2021-3281.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly apply the recommended fixes to mitigate the risk of potential attacks.
You can find more information about this vulnerability, including the technical details and the official fix, in the Django project's security advisory at https://github.com/django/django/security/advisories/GHSA-fvgf-6h6h-3322.
Related vulnerabilities
Recent vulnerabilities recorded for django.
