CVE-2017-7233: Open Redirect and XSS Vulnerability in Django
Summary
CVE-2017-7233: Django open redirect and possible XSS attack via user-supplied numeric redirect URLs. Affects django across 3 version ranges.
>= 1.8a1, < 1.8.18
>= 1.9a1, < 1.9.13
>= 1.10a1, < 1.10.7
Fixed in 1.8.18, 1.9.13 or 1.10.7, depending on the release line you run. How to fix ↓
Also tracked for
- py-django · Alpine:v3.10
The same CVE-2017-7233 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework used for building web applications. It provides a robust set of tools and features for developers to create secure and scalable websites. However, versions 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 of Django are affected by an open redirect vulnerability. This vulnerability arises when user input is used to redirect the user to an 'on success' URL. The security check for these redirects, specifically the 'django.utils.http.is_safe_url()' function, incorrectly considers some numeric URLs as safe, leading to the open redirect vulnerability. Additionally, if a developer relies on 'is_safe_url()' to provide safe redirect targets and includes such a URL in a link, they may be susceptible to a cross-site scripting (XSS) attack.
Vulnerability Detail
The open redirect vulnerability in Django allows an attacker to craft a malicious URL that redirects users to a different website, potentially leading to phishing attacks or other malicious activities. The incorrect handling of numeric URLs as safe by the 'is_safe_url()' function enables an attacker to construct URLs that appear safe but actually redirect to an attacker-controlled site. This can trick users into visiting malicious websites. Furthermore, if a developer uses 'is_safe_url()' to validate URLs and includes them in links, an attacker can exploit this to inject malicious scripts and perform XSS attacks on unsuspecting users.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.8a1, < 1.8.181.8.18pip install --upgrade "django==1.8.18" -
>= 1.9a1, < 1.9.131.9.13pip install --upgrade "django==1.9.13" -
>= 1.10a1, < 1.10.71.10.7pip install --upgrade "django==1.10.7"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround is to manually validate and sanitize redirect URLs before passing them to the 'redirect()' function. Developers should carefully review and validate user input to ensure that only trusted and safe URLs are used for redirects. This can be done by checking the URL scheme, hostname, and path to ensure they match the expected values. Additionally, it is recommended to use a whitelist approach and only allow specific URLs for redirection.
Conclusion
The open redirect and XSS vulnerability in Django versions 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 can potentially expose web applications to phishing attacks, open redirects, and cross-site scripting attacks. It is crucial to upgrade to the latest patched versions of Django to mitigate these risks. Regularly updating Django and other dependencies is essential for maintaining the security of your web applications. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
An open redirect vulnerability occurs when a web application allows user input to be used in redirect URLs without proper validation. This can enable attackers to craft malicious URLs that redirect users to a different website, potentially leading to phishing attacks or other malicious activities.
Cross-site scripting (XSS) is a type of security vulnerability where an attacker injects malicious scripts into web pages viewed by other users. This can lead to the theft of sensitive information, session hijacking, or other malicious actions.
To protect your Django application, it is recommended to upgrade to the latest version of Django that includes the fix for this vulnerability. Regularly updating Django and other dependencies is crucial for maintaining the security of your web applications.
There are no known public exploits of this vulnerability at the time of writing. However, it is important to address this vulnerability promptly to prevent potential attacks.
You can find more information about this vulnerability, including the specific versions affected and fixed, in the advisory provided by the GitHub Advisory Database. The link to the advisory is available in the 'database_specific' field of the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
