Header Injection Vulnerability in python-django
Summary
CVE-2021-32052: In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). Affects python-django across 3 version ranges.
< 2:2.2.22-1
>= 635d53a86a36cde7866b9caefeb64d809e6bfcd9, < df9fd4661e203d41c189054d8b23d256815e14fc
>= 29360893df0931703cb2fe0c0fbc0fc963e64ead, < 09a7df8301bef5a5ac957371ae9e19c68acdca0a
Fixed in 2:2.2.22-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-django is a popular web framework for building web applications in Python. It provides a set of tools and libraries that simplify the development process. The framework allows developers to create dynamic and interactive websites with ease. However, a vulnerability has been discovered in python-django that could lead to header injection.
Vulnerability Detail
The vulnerability, identified as CVE-2021-32052, exists in Django versions 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2. It affects applications that use the URLValidator class and do not use the URLField form field. The issue arises from the fact that URLValidator does not prohibit newlines and tabs. This allows an attacker to inject malicious headers into HTTP responses if the application uses values with newlines. Django itself is not affected as HttpResponse already prohibits newlines in HTTP headers. The impact of this vulnerability includes potential header injection attacks, which can lead to various security risks such as cross-site scripting (XSS) or cross-site request forgery (CSRF) attacks.
How To Fix
Minimum fixed version
2:2.2.22-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, developers can implement a workaround by manually validating URLs and ensuring that they do not contain newlines or tabs. This can be done by using regular expressions or other URL validation techniques to sanitize user input and remove any potentially malicious characters.
Conclusion
The header injection vulnerability in python-django can lead to serious security risks if left unaddressed. It is crucial for developers to upgrade to the latest patched versions of Django or implement the recommended workarounds. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-django →
FAQ
The vulnerability allows an attacker to inject malicious headers into HTTP responses, potentially leading to security risks such as cross-site scripting (XSS) or cross-site request forgery (CSRF) attacks.
The vulnerability affects Django versions 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2.
No, Django itself is not affected as HttpResponse already prohibits newlines in HTTP headers.
To fix this vulnerability, it is recommended to upgrade to the latest patched versions of Django (2.2.22, 3.1.10, or 3.2.2).
If upgrading to the latest version is not immediately feasible, developers can manually validate URLs and ensure they do not contain newlines or tabs.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
