Django Trailing Newline Bypass Vulnerability - CVE-2021-44420
Summary
CVE-2021-44420: In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths. Affects python-django across 2 version ranges.
< 2:2.2.25-1~deb11u1
>= 635d53a86a36cde7866b9caefeb64d809e6bfcd9, < 79d8dcefb2739176839fa76f8780aca5aa9b7101
Fixed in 2:2.2.25-1~deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and offers features such as an ORM, routing, authentication, and an admin interface. The vulnerability CVE-2021-44420 affects specific versions of Django, allowing HTTP requests with trailing newlines to bypass access controls based on URL paths, potentially exposing sensitive resources.
Vulnerability Detail
The vulnerability arises from improper handling of HTTP requests that contain trailing newlines in URLs. This flaw can lead to unauthorized access to resources that should be protected by access control mechanisms. The affected versions of Django include 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10. Attackers can exploit this vulnerability to gain access to restricted areas of a web application, posing a significant security risk.
How To Fix
Minimum fixed version
2:2.2.25-1~deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to implement additional input validation on the server-side to reject requests with trailing newlines in URLs. This can be done by modifying the request handling logic to sanitize incoming URLs before processing them.
Conclusion
CVE-2021-44420 is a significant vulnerability in Django that can lead to unauthorized access due to improper handling of trailing newlines in URLs. It is crucial for users to upgrade to the patched versions to mitigate this risk. For those unable to upgrade immediately, implementing input validation can serve as a temporary measure.
See every vulnerability recorded for python-django →
FAQ
CVE-2021-44420 is a vulnerability in Django that allows HTTP requests with trailing newlines to bypass access control mechanisms.
The affected versions include Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2021-44420 is 7.3, indicating a high severity level.
If an immediate upgrade is not possible, consider implementing server-side input validation to reject requests with trailing newlines as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
