Directory Traversal Vulnerability in Django Package
Summary
CVE-2021-28658: In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Affects python-django across 2 version ranges.
< 2:2.2.20-1
>= 635d53a86a36cde7866b9caefeb64d809e6bfcd9, < ad9fa56a17bf9691615e9bb6e41d08d51cfe8a5d
Fixed in 2:2.2.20-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, routing, templating, and security features. However, certain versions of Django are susceptible to a directory traversal vulnerability that can be exploited through maliciously crafted file names during file uploads.
Vulnerability Detail
The vulnerability, identified as CVE-2021-28658, affects Django versions 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8. The MultiPartParser component of Django allows for directory traversal, which can enable attackers to upload files to unintended directories on the server. This could lead to unauthorized access to sensitive files or execution of malicious scripts, posing a significant security risk to applications using affected versions of Django.
How To Fix
Minimum fixed version
2:2.2.20-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation on file uploads to restrict file names and paths. Ensure that uploaded files are sanitized and do not contain any directory traversal characters such as '../'.
Conclusion
The directory traversal vulnerability in Django, identified as CVE-2021-28658, poses a significant risk to applications using affected versions. It is crucial to update to a secure version of Django to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround while upgrades are being planned.
See every vulnerability recorded for python-django →
FAQ
CVE-2021-28658 is a vulnerability in Django that allows for directory traversal through maliciously crafted file names during file uploads.
Django versions 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8 are affected by this vulnerability.
Exploitation of this vulnerability can lead to unauthorized access to sensitive files on the server or execution of malicious scripts.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for CVE-2021-28658 is 5.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
