Exponential DoS Vulnerability in django-filter Package
Summary
DEBIAN-CVE-2020-15225: django-filter is a generic system for filtering Django QuerySets based on user selections. Affects django-filter versions < 2.4.0-1. Fixed in 2.4.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
django-filter is a powerful library designed for filtering Django QuerySets based on user-defined selections. It simplifies the process of creating complex queries by allowing developers to define filters in a declarative manner. However, prior to version 2.4.0, django-filter was vulnerable to a Denial of Service (DoS) attack due to its handling of automatically generated NumberFilter instances, which could be exploited through malicious input.
Vulnerability Detail
The vulnerability arises from the way django-filter processes input for NumberFilter instances. Specifically, when a value is converted to an integer, it could be manipulated using exponential notation with large exponents, potentially leading to a DoS condition. This could allow an attacker to exhaust server resources, causing the application to become unresponsive. The issue was identified in versions prior to 2.4.0, where the absence of a maximum value validator left the system open to such attacks.
How To Fix
Minimum fixed version
2.4.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade django-filterTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, users can manually apply a MaxValueValidator to their NumberFilter instances. For example:
from django.core.validators import MaxValueValidator
class MyFilterSet(FilterSet):
my_number = NumberFilter(validators=[MaxValueValidator(1e50)])
Conclusion
The django-filter package has a critical vulnerability that can lead to Denial of Service attacks through improper handling of NumberFilter inputs. Upgrading to version 2.4.0 or later is essential to secure your application. If an immediate upgrade is not possible, implementing a MaxValueValidator can serve as a temporary workaround.
See every vulnerability recorded for django-filter →
FAQ
The vulnerability allows for a Denial of Service (DoS) attack through maliciously crafted input that exploits the conversion of values in NumberFilter instances.
You can check if your application is affected by using the Vulert playground, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
Failure to address this vulnerability may lead to application downtime or unresponsiveness due to resource exhaustion from DoS attacks.
Yes, you can manually apply a MaxValueValidator to your NumberFilter instances to limit the input values and mitigate the risk.
You can find more information about django-filter and its features in the official Django documentation or the project's repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for django-filter.
