Directory Traversal Vulnerability in Django Package
Summary
CVE-2021-3281: In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with a... Affects python-django across 2 version ranges.
< 2:2.2.18-1
>= 635d53a86a36cde7866b9caefeb64d809e6bfcd9, < fc0c8cfa492b2d7b82263e71e486f3829ad7c43a
Fixed in 2:2.2.18-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, authentication, and an admin interface. However, certain versions of Django are vulnerable to a directory traversal issue that can be exploited through the 'extract' method in the django.utils.archive module.
Vulnerability Detail
In Django versions 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the 'extract' method allows attackers to perform directory traversal attacks. This vulnerability arises when an archive containing absolute paths or relative paths with dot segments is processed. If exploited, it could lead to unauthorized access to sensitive files on the server, potentially compromising the integrity and confidentiality of the application.
How To Fix
Minimum fixed version
2:2.2.18-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to avoid using the 'startapp --template' and 'startproject --template' commands with untrusted archives. Ensure that any archives processed by your application are from trusted sources and do not contain absolute paths or dot segments.
Conclusion
The directory traversal vulnerability in Django poses a significant risk to applications using affected versions. It is crucial to upgrade to the latest secure versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python-django →
FAQ
Directory traversal is a web security vulnerability that allows an attacker to access files and directories that are stored outside the intended directory.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Django versions 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6 are affected by this vulnerability.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
If immediate upgrading is not possible, avoid using vulnerable commands with untrusted archives and ensure that your application is not processing potentially malicious files.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
