CVE-2016-2512: Django - Arbitrary URL Redirection and XSS Vulnerability
Summary
CVE-2016-2512: The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (X... Affects django across 3 version ranges.
< 1.8.10
>= 1.9, < 1.9.3
< c5544d289233f501917e25970c03ed444abbd4f0
Fixed in 1.8.10 or 1.9.3, depending on the release line you run. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2016-2512 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that simplifies the development of web applications. It provides various utilities and functions to handle common web development tasks. The 'utils.http.is_safe_url' function in Django versions before 1.8.10 and 1.9.x before 1.9.3 is vulnerable to an arbitrary URL redirection and cross-site scripting (XSS) attack. This function is responsible for validating whether a given URL is safe or not. However, due to a flaw in the implementation, it fails to properly handle URLs containing basic authentication, allowing remote attackers to redirect users to arbitrary websites and potentially conduct phishing attacks or XSS attacks.
Vulnerability Detail
The vulnerability in Django arises from the 'utils.http.is_safe_url' function's inability to correctly validate URLs with basic authentication. Attackers can exploit this by crafting malicious URLs that include basic authentication credentials and tricking users into clicking on them. When a user clicks on the malicious URL, they may be redirected to an attacker-controlled website, leading to potential phishing attacks. Additionally, if the attacker-controlled website contains malicious scripts, it can also result in cross-site scripting (XSS) attacks, compromising the user's sensitive information or performing unauthorized actions on their behalf.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.8.101.8.10pip install --upgrade "django==1.8.10" -
>= 1.9, < 1.9.31.9.3pip install --upgrade "django==1.9.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround can be implemented by modifying the 'utils.http.is_safe_url' function to include additional checks for URLs with basic authentication. Here is an example of a possible workaround code snippet:
from django.utils.http import is_safe_url
def safe_url_with_basic_auth(url):
if '@' in url:
# Perform additional checks for basic authentication
# ... (add your custom logic here)
return False
return is_safe_url(url)
By implementing this workaround, the function will reject URLs with basic authentication, preventing the vulnerability from being exploited.
Conclusion
The vulnerability in Django versions before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to perform arbitrary URL redirection and potentially conduct XSS attacks. To mitigate this vulnerability, it is crucial to upgrade Django to the fixed versions or implement the provided workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability allows remote attackers to redirect users to arbitrary websites, potentially leading to phishing attacks. It can also enable cross-site scripting (XSS) attacks, compromising user data and allowing unauthorized actions on their behalf.
The vulnerability affects Django versions before 1.8.10 and 1.9.x before 1.9.3. If you are using an older version, it is recommended to upgrade to a fixed version.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any known vulnerabilities, including this one.
While specific exploits targeting this vulnerability may exist, they have not been disclosed publicly. However, it is crucial to address this vulnerability promptly to mitigate the risk of potential attacks.
If upgrading Django is not immediately feasible, you can implement the provided workaround code to mitigate the vulnerability temporarily. However, upgrading to the fixed version is the recommended long-term solution.
Related vulnerabilities
Recent vulnerabilities recorded for django.
