Directory Traversal Vulnerability in Python Django - CVE-2024-39330
Summary
DEBIAN-CVE-2024-39330: An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Affects python-django versions < 3:4.2.14-1. Fixed in 3:4.2.14-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python Django is a high-level web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and comes with a variety of built-in features. However, certain derived classes of the django.core.files.storage.Storage base class can introduce vulnerabilities if they override the generate_filename() method without proper file-path validation, leading to potential directory traversal attacks.
Vulnerability Detail
An issue was discovered in Django versions 5.0 before 5.0.7 and 4.2 before 4.2.14. The vulnerability arises when derived classes of the django.core.files.storage.Storage base class override the generate_filename() method without replicating the necessary file-path validations from the parent class. This oversight can allow attackers to exploit directory traversal via specially crafted inputs during a save() call, potentially leading to unauthorized access to sensitive files on the server.
How To Fix
Minimum fixed version
3:4.2.14-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement additional file-path validation in their overridden generate_filename() methods to prevent directory traversal. This can be done by ensuring that the generated file paths do not contain any directory traversal sequences (e.g., '../').
Conclusion
The CVE-2024-39330 vulnerability in Django poses a significant risk due to improper file-path validation in derived classes of the Storage base class. It is crucial for developers to update to the patched version or implement workarounds to mitigate potential attacks.
See every vulnerability recorded for python-django →
FAQ
CVE-2024-39330 is a vulnerability in Django that allows for potential directory traversal attacks due to improper validation in overridden methods.
Django versions 5.0 before 5.0.7 and 4.2 before 4.2.14 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, implement additional file-path validation in your overridden generate_filename() methods as a temporary workaround.
No, built-in Storage subclasses are unaffected by this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
