CVE-2015-0221: Django - Denial of Service via Long Line in File

Background

Django is a popular Python web framework that simplifies the development of web applications. It provides a set of tools and libraries for handling common web development tasks, such as URL routing, database integration, and template rendering. The django.views.static.serve view is responsible for serving static files in Django applications. However, prior to versions 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3, this view had a vulnerability that could be exploited to cause a denial of service (DoS) attack.

Vulnerability Detail

The vulnerability (CVE-2015-0221) in Django's django.views.static.serve view arises from the way it reads files. Specifically, it reads files line by line, without any limit on line length. This means that if an attacker provides a file with an excessively long line, it can cause the server to consume excessive memory, leading to a DoS condition. By repeatedly exploiting this vulnerability, an attacker could potentially exhaust the server's memory resources, rendering it unresponsive or causing it to crash.

pip install --upgrade "django==6.1.2"

Workaround

If updating Django is not immediately feasible, a temporary workaround can be implemented by modifying the django.views.static.serve view to limit the length of lines read from files. Here is an example of how this can be done in the code:

from django.views.static import serve

MAX_LINE_LENGTH = 1024  # Set the maximum line length

def serve_with_line_limit(request, *args, **kwargs):
    with open(kwargs['document_root'] + kwargs['path'], 'r') as file:
        for line in file:
            if len(line) > MAX_LINE_LENGTH:
                line = line[:MAX_LINE_LENGTH]
            yield line

# Replace the original view with the modified one
django.views.static.serve = serve_with_line_limit

This workaround limits the length of each line read from files to a specified maximum value (e.g., 1024 characters). However, it is important to note that this is only a temporary solution and updating to a patched version of Django is still strongly recommended.

Conclusion

The vulnerability (CVE-2015-0221) in Django's django.views.static.serve view allows remote attackers to cause a denial of service (DoS) condition by providing a file with an excessively long line. To mitigate this vulnerability, it is recommended to update Django to version 1.4.18, 1.6.10, or 1.7.3. If immediate update is not possible, a temporary workaround can be implemented by limiting the length of lines read from files. For further assistance or support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for django →

FAQ