Cross-Site Scripting Vulnerability in Django - CVE-2015-0220
Summary
CVE-2015-0220: The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (... Affects python-django versions < 1.7.1-1.1. Fixed in 1.7.1-1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, routing, authentication, and templating. However, versions prior to 1.4.18, 1.6.10, and 1.7.3 are vulnerable to a cross-site scripting (XSS) attack due to improper handling of leading whitespaces in URLs.
Vulnerability Detail
The vulnerability arises from the django.util.http.is_safe_url function, which fails to properly sanitize URLs that contain leading whitespaces. This oversight allows attackers to craft malicious URLs, such as those starting with '\njavascript:', which can lead to XSS attacks. If exploited, this vulnerability can allow attackers to execute arbitrary JavaScript in the context of the user's session, potentially compromising sensitive information.
How To Fix
Minimum fixed version
1.7.1-1.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing input validation to strip leading whitespaces from URLs before processing them. This can be done by modifying the URL handling logic in your application to include a check that removes any leading whitespace characters.
Conclusion
CVE-2015-0220 is a significant vulnerability in certain versions of Django that can lead to XSS attacks. It is crucial to upgrade to a secure version to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround until an upgrade can be performed.
See every vulnerability recorded for python-django →
FAQ
CVE-2015-0220 is a vulnerability in Django that allows for cross-site scripting (XSS) attacks due to improper handling of leading whitespaces in URLs.
Django versions before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If exploited, this vulnerability can allow attackers to execute arbitrary JavaScript in the user's browser, potentially leading to data theft or session hijacking.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
