Django ModelAdmin Access Bypass Vulnerability - CVE-2016-2048
Summary
CVE-2016-2048: Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects... Affects python-django across 3 version ranges.
< 1.9.2-1
< e70a309c428cfd4e600dc9fa0c7269b1e7a8efcd
< e403f2217e67301526a0df5ea5be42e190e00e10
Fixed in 1.9.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an administrative interface that allows users to manage application data. The ModelAdmin class is a key component of this interface, enabling developers to customize how models are displayed and interacted with. However, a vulnerability in versions 1.9.x before 1.9.2 allows authenticated users to exploit the 'Save as New' feature, potentially bypassing access restrictions.
Vulnerability Detail
CVE-2016-2048 is a security vulnerability in Django versions 1.9.x prior to 1.9.2. When the ModelAdmin.save_as option is set to True, it allows remote authenticated users to create new ModelAdmin objects using the 'Save as New' feature while editing existing objects. This can lead to unauthorized access and manipulation of data, as users can leverage their 'change' permissions to create new instances of models they should not have access to. The vulnerability arises from insufficient checks on user permissions during the save operation.
How To Fix
Minimum fixed version
1.9.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider disabling the 'Save as New' feature by setting ModelAdmin.save_as to False in your admin configuration. This can be done by modifying your admin.py file as follows:
from django.contrib import admin from .models import YourModel
class YourModelAdmin(admin.ModelAdmin):
save_as = False
admin.site.register(YourModel, YourModelAdmin)
Conclusion
CVE-2016-2048 presents a significant security risk for applications using Django 1.9.x prior to 1.9.2, allowing unauthorized access through the ModelAdmin interface. It is crucial to upgrade to the latest version or implement workarounds to mitigate this vulnerability.
See every vulnerability recorded for python-django →
FAQ
CVE-2016-2048 is a vulnerability in Django that allows authenticated users to bypass access restrictions when creating new ModelAdmin objects.
Django versions 1.9.x prior to 1.9.2 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2016-2048 is 5.5, indicating a moderate level of severity.
If an immediate upgrade is not possible, consider disabling the 'Save as New' feature in your ModelAdmin configuration as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
