Denial of Service Vulnerability in Django File Upload Handling
Summary
CVE-2014-0481: The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file... Affects python-django versions < 1.6.6-1. Fixed in 1.6.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for web development, including an ORM, URL routing, and a templating engine. However, prior to certain versions, Django's file upload handling system had a vulnerability that allowed attackers to exploit the sequential file name generation process, leading to potential denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2014-0481, arises from the default configuration of Django's file upload handling system. In versions before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, the system generates file names sequentially when a file with a conflicting name is uploaded. This allows remote attackers to upload multiple files with the same name, causing excessive CPU consumption and potentially leading to a denial of service.
How To Fix
Minimum fixed version
1.6.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a custom file naming strategy that avoids sequential naming conflicts. This can be done by appending a unique identifier (such as a timestamp or a random string) to the file names before saving them. For example, you can modify your file upload handling code as follows:
import os
import uuid
def handle_uploaded_file(f):
unique_filename = f'{uuid.uuid4()}_{f.name}'
with open(os.path.join('uploads/', unique_filename), 'wb+') as destination:
for chunk in f.chunks():
destination.write(chunk)
Conclusion
CVE-2014-0481 is a significant vulnerability in Django's file upload handling system that can lead to denial of service. It is crucial for developers using affected versions to upgrade to a secure version or implement workarounds to mitigate the risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python-django →
FAQ
CVE-2014-0481 is a vulnerability in Django's file upload handling system that allows attackers to cause denial of service by uploading multiple files with the same name.
Django versions before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The main consequence is denial of service due to excessive CPU consumption when multiple files with the same name are uploaded.
Yes, implementing a custom file naming strategy to avoid name conflicts can serve as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
