Infinite Loop Vulnerability in Django's MultiPartParser
Summary
CVE-2022-23833: An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Affects python-django across 4 version ranges.
< 2:2.2.28-1~deb11u1
< c477b761804984c932704554ad35f78a2e230c6a
< d16133568ef9c9b42cb7a08bdf9ff3feec2e5468
< f9c7d48fdd6f198a6494a9202f90242f176e4fc9
Fixed in 2:2.2.28-1~deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and provides a robust set of features including an ORM, authentication, and an admin interface. The MultiPartParser is a component of Django responsible for handling file uploads in multipart forms. This vulnerability affects versions of Django prior to 2.2.27, 3.2.12, and 4.0.2, making it critical for applications relying on these versions to handle file uploads securely.
Vulnerability Detail
The vulnerability arises from the way the MultiPartParser processes certain inputs in multipart forms. Specifically, it can enter an infinite loop when parsing files, which can lead to denial of service (DoS) conditions. This issue can be exploited by sending specially crafted multipart form data, causing the application to hang indefinitely while attempting to process the input. The technical implications include potential resource exhaustion and unavailability of the web application, impacting user experience and service reliability.
How To Fix
Minimum fixed version
2:2.2.28-1~deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing input validation to reject malformed multipart form data. Additionally, you can limit the size of file uploads to mitigate the impact of potential exploitation.
Conclusion
The infinite loop vulnerability in Django's MultiPartParser poses a significant risk to applications using affected versions. It is crucial to upgrade to the latest secure versions to ensure the integrity and availability of your web applications. Implementing workarounds can provide temporary relief, but a permanent fix through upgrading is recommended.
See every vulnerability recorded for python-django →
FAQ
Django versions 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 are affected.
Exploitation of this vulnerability can lead to an infinite loop in the application, resulting in denial of service and making the application unresponsive.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Yes, you can implement input validation to reject malformed multipart form data and limit the size of file uploads as a temporary workaround.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
