CVE-2017-7234: Open Redirect Vulnerability in Django
Summary
CVE-2017-7234: Django open redirect. Affects django across 3 version ranges.
>= 1.8, < 1.8.18
>= 1.9, < 1.9.13
>= 1.10, < 1.10.7
Fixed in 1.8.18, 1.9.13 or 1.10.7, depending on the release line you run. How to fix ↓
Also tracked for
- py-django · Alpine:v3.10
The same CVE-2017-7234 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework used for building web applications. It provides a set of tools and libraries that simplify the development process. The vulnerability in question affects Django versions 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18. This vulnerability specifically targets the django.views.static.serve() view and allows for open redirect attacks.
Vulnerability Detail
The open redirect vulnerability arises when a maliciously crafted URL is used to access a Django site. By exploiting this vulnerability, an attacker can redirect users to any other domain of their choice. This can lead to various malicious activities, such as phishing attacks or the exploitation of user trust. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.8, < 1.8.181.8.18pip install --upgrade "django==1.8.18" -
>= 1.9, < 1.9.131.9.13pip install --upgrade "django==1.9.13" -
>= 1.10, < 1.10.71.10.7pip install --upgrade "django==1.10.7"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround can be implemented by modifying the code that utilizes the django.views.static.serve() view. By validating and sanitizing the input URL, developers can prevent the exploitation of the open redirect vulnerability. Here is an example of how the code can be modified:
from django.http import HttpResponseRedirect
from urllib.parse import urlparse
def serve(request):
url = request.GET.get('url')
parsed_url = urlparse(url)
if parsed_url.netloc == 'trusted-domain.com':
return HttpResponseRedirect(url)
else:
return HttpResponseRedirect('https://trusted-domain.com')
This code snippet checks if the provided URL belongs to a trusted domain before redirecting. If the URL is not from a trusted domain, it redirects to a default trusted domain.
Conclusion
The open redirect vulnerability in Django can have serious consequences, allowing attackers to redirect users to malicious websites. It is crucial to promptly address this vulnerability by upgrading Django to the patched versions or implementing the provided workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The open redirect vulnerability allows attackers to redirect users to malicious websites, potentially leading to phishing attacks or the exploitation of user trust.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this Django vulnerability.
Yes, this vulnerability can be exploited remotely by sending a maliciously crafted URL to the Django site.
There have been reported instances of this vulnerability being exploited in the wild. It is important to promptly apply the necessary patches or workarounds to mitigate the risk.
Yes, the fix for this vulnerability is to upgrade Django to version 1.10.7, 1.9.13, or 1.8.18, depending on the version being used. These versions include the necessary patches to address the open redirect vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
