Directory Traversal Vulnerability in Django Package
Summary
CVE-2021-31542: In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names. Affects python-django across 4 version ranges.
< 2:2.2.21-1
< 04ac1624bdc2fa737188401757cf95ced122d26d
< 25d84d64122c15050a0ee739e859f22ddab5ac48
< c98f446c188596d4ba6de71d1b77b4a6c5c2a007
Fixed in 2:2.2.21-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and comes with a plethora of features, including an ORM, authentication, and an admin interface. However, certain versions of Django are susceptible to a directory traversal vulnerability, which can allow attackers to manipulate file uploads in a harmful way.
Vulnerability Detail
In Django versions 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, the MultiPartParser, UploadedFile, and FieldFile components allowed directory traversal through crafted file names. This vulnerability can lead to unauthorized access to sensitive files on the server, potentially exposing confidential data or allowing further exploitation of the system.
How To Fix
Minimum fixed version
2:2.2.21-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not possible, consider implementing input validation on file names to prevent directory traversal attacks. Ensure that uploaded file names do not contain any path traversal characters such as '../'.
Conclusion
The directory traversal vulnerability in certain versions of Django poses significant risks to applications using this framework. It is crucial to upgrade to the latest secure versions to protect against potential exploitation. Implementing input validation can serve as a temporary measure until an upgrade can be performed.
See every vulnerability recorded for python-django →
FAQ
Directory traversal is a security vulnerability that allows an attacker to access files and directories that are stored outside the web root folder.
You can use Vulert to check if your application is affected by this vulnerability. Simply upload your manifest file like package-lock.json to monitor for vulnerabilities.
Exploitation of this vulnerability can lead to unauthorized access to sensitive files, data breaches, and potential further attacks on the server.
Yes, you can implement input validation on file uploads to block malicious file names that could exploit the vulnerability.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
