CVE-2021-44420: Django - Bypass of Access Control Based on URL Paths
Summary
CVE-2021-44420: In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths. Affects django across 3 version ranges.
>= 2.2.0, < 2.2.25
>= 3.1.0, < 3.1.14
>= 3.2.0, < 3.2.10
Fixed in 2.2.25, 3.1.14 or 3.2.10, depending on the release line you run. How to fix ↓
Also tracked for
- django · PyPI
- python-django · Debian:11
- django · PyPI
The same CVE-2021-44420 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Django is a popular open-source web framework written in Python. It provides a set of tools and libraries for building web applications quickly and efficiently. Django is widely used for developing secure and scalable web applications. However, versions 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10 are vulnerable to a security issue that allows HTTP requests for URLs with trailing newlines to bypass upstream access control based on URL paths.
Vulnerability Detail
The vulnerability in Django allows attackers to bypass access control mechanisms by appending newline characters to the end of URLs. This can lead to unauthorized access to sensitive resources or actions that are protected by URL-based access controls. By exploiting this vulnerability, an attacker could potentially perform actions that should be restricted, such as accessing or modifying user data, executing arbitrary code, or escalating privileges. The impact of this vulnerability depends on the specific access controls implemented in the affected Django application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.2.0, < 2.2.252.2.25 -
>= 3.1.0, < 3.1.143.1.14 -
>= 3.2.0, < 3.2.103.2.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can manually validate and sanitize URLs to remove any trailing newline characters before processing them. This can be done by using string manipulation functions or regular expressions to remove any newline characters at the end of the URL. Here is an example of how to remove trailing newlines in Python:
url = url.rstrip('\n')
Conclusion
In conclusion, the vulnerability in Django versions 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10 allows for the bypass of access control based on URL paths. This can lead to unauthorized access to sensitive resources or actions that are protected by URL-based access controls. It is crucial to upgrade Django to the fixed versions and review any custom access control rules or configurations to ensure the security of your application. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for django →
FAQ
The impact of this vulnerability depends on the specific access controls implemented in the affected Django application. In some cases, it could lead to unauthorized access to sensitive resources or actions that are protected by URL-based access controls.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your application's manifest file, such as package-lock.json, to identify and alert you about open-source vulnerabilities in your software.
Yes, as a temporary workaround, you can manually validate and sanitize URLs to remove any trailing newline characters before processing them. This can help mitigate the risk of exploitation.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to apply the recommended fixes and security updates to protect your application from potential attacks.
You can find more information about this vulnerability in the Django project's security advisory, which is available at https://www.djangoproject.com/weblog/2023/nov/06/security-releases/. Additionally, you can refer to the CVE identifier CVE-2021-44420 for further details.
Related vulnerabilities
Recent vulnerabilities recorded for django.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
