CVE-2024-39330: Django Path Traversal vulnerability

Background

Django is a popular Python web framework that simplifies the development of web applications. It provides various features and utilities for handling web requests, managing databases, and rendering templates. The vulnerability in question affects Django versions 5.0 before 5.0.7 and 4.2 before 4.2.14. It specifically impacts derived classes of the django.core.files.storage.Storage base class that override the generate_filename() method without replicating the file-path validations from the parent class. This oversight potentially allows for directory traversal attacks when certain inputs are provided during a save() call. It's important to note that built-in Storage subclasses are not affected by this vulnerability.

Vulnerability Detail

The Django Path Traversal vulnerability arises due to the lack of proper file-path validations in derived classes of the django.core.files.storage.Storage base class. When developers override the generate_filename() method without including the necessary validations, it opens up the possibility of directory traversal attacks. An attacker could exploit this vulnerability by providing malicious inputs during a save() call, potentially allowing them to access files outside of the intended directory. This could lead to unauthorized access, data leakage, or even remote code execution depending on the context in which the vulnerable code is used.

pip install --upgrade "django==6.1.2"

Workaround

If immediate updating is not feasible, developers can implement a workaround by manually adding the file-path validations to the overridden generate_filename() method in their derived classes. The following code snippet demonstrates an example of how this can be done:

from django.core.files.storage import Storage


class CustomStorage(Storage):
    def generate_filename(self, filename):
        # Add file-path validations here
        # to prevent directory traversal
        # ... (existing code)
        # ... (additional validations)
        # ... (return the sanitized filename)
        pass

By incorporating the necessary validations, developers can safeguard against directory traversal attacks until they can update to the fixed Django versions.

Conclusion

The Django Path Traversal vulnerability (CVE-2024-39330) affects Django versions 5.0 before 5.0.7 and 4.2 before 4.2.14. It arises due to the lack of proper file-path validations in derived classes of the django.core.files.storage.Storage base class. Attackers can exploit this vulnerability to perform directory traversal attacks and potentially gain unauthorized access or execute arbitrary code. Developers should update to the fixed Django versions and ensure that their codebase includes the necessary file-path validations to mitigate this vulnerability.

See every vulnerability recorded for django →

FAQ