Cross-Site Scripting Vulnerability in Django's HttpResponseRedirect Classes
Summary
CVE-2012-3442: The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote a... Affects python-django versions < 1.4.1-1. Fixed in 1.4.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, authentication, and URL routing. However, certain versions of Django, specifically before 1.3.2 and 1.4.x before 1.4.1, contain a vulnerability in the HttpResponseRedirect and HttpResponsePermanentRedirect classes that fails to validate the scheme of redirect targets, exposing applications to potential cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the lack of validation on the scheme of URLs used in redirects. Attackers can exploit this flaw by crafting malicious data: URLs that, when redirected to, can execute arbitrary JavaScript in the context of the user's browser. This could lead to unauthorized actions being performed on behalf of the user, data theft, or session hijacking. The issue affects all versions of Django prior to the specified fixes, making it critical for users to upgrade to secure versions.
How To Fix
Minimum fixed version
1.4.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing a middleware that sanitizes redirect URLs to ensure they do not contain unsafe schemes. Here is a simple example of such middleware:
class SafeRedirectMiddleware:
def __init__(self, get_response):
self.get_response = get_response
def __call__(self, request):
response = self.get_response(request)
if response.status_code in [302, 301]:
redirect_url = response['Location']
if redirect_url.startswith('data:'):
return HttpResponseRedirect('/safe-url/') # Redirect to a safe URL
return response
Conclusion
The CVE-2012-3442 vulnerability poses a significant risk to applications using affected versions of Django. It is crucial to upgrade to version 1.4.1 or later to mitigate this risk. Implementing workarounds can provide temporary relief, but upgrading is the best long-term solution.
See every vulnerability recorded for python-django →
FAQ
CVE-2012-3442 is a vulnerability in Django's redirect classes that allows for potential XSS attacks due to improper URL scheme validation.
Django versions before 1.3.2 and 1.4.x before 1.4.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized actions, data theft, and session hijacking due to the execution of malicious scripts in the user's browser.
Yes, you can implement a middleware to sanitize redirect URLs and prevent unsafe schemes from being used.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
