External Redirection Vulnerability in django-grappelli
Summary
CVE-2021-46898: views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //example.com) attack. Affects django-grappelli across 2 version ranges.
< 2.15.2
< 4ca94bcda0fa2720594506853d85e00c8212968f
Fixed in 4ca94bcda0fa2720594506853d85e00c8212968f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
django-grappelli is a package for Django that provides a customizable admin interface. It enhances the default Django admin site with a variety of features and improvements. The package is widely used in Django projects to enhance the user experience and streamline administrative tasks. However, an external redirection vulnerability has been identified in versions before 2.15.2 of django-grappelli.
Vulnerability Detail
The vulnerability exists in the 'views/switch.py' file of django-grappelli. The code attempts to prevent external redirection by checking if the URL starts with a forward slash ('/'). However, it fails to consider protocol-relative URLs (e.g., '//example.com'), which can be exploited by an attacker. By crafting a malicious URL, an attacker can redirect users to a different website, potentially leading to phishing attacks or other malicious activities.
How To Fix
Minimum fixed version
4ca94bcda0fa2720594506853d85e00c8212968f
This is the first release that contains the fix.
pip install --upgrade "django-grappelli==4ca94bcda0fa2720594506853d85e00c8212968f"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not feasible at the moment, a temporary workaround is to manually modify the 'views/switch.py' file. Locate the line that checks for URL validity and add an additional condition to handle protocol-relative URLs. Here's an example of the modified code:
# Original code
if url.startswith('/'):
# Existing code
# Modified code
if url.startswith('/') or url.startswith('//'):
# Additional condition to handle protocol-relative URLs
Conclusion
In conclusion, the external redirection vulnerability in django-grappelli can be mitigated by upgrading to version 2.15.2 or later. Alternatively, you can apply the provided workaround until you are able to upgrade. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django-grappelli →
FAQ
django-grappelli is a package for Django that enhances the default admin interface with additional features and improvements. It is widely used in Django projects to improve the user experience and streamline administrative tasks.
This vulnerability allows an attacker to redirect users to a different website by crafting a malicious URL. This can lead to phishing attacks or other malicious activities.
Versions of django-grappelli before 2.15.2 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade django-grappelli to version 2.15.2 or later. Alternatively, you can apply the provided workaround until you are able to upgrade.
Yes, a workaround is available. You can modify the 'views/switch.py' file to handle protocol-relative URLs. Please refer to the 'workaround' section for detailed instructions.
