CVE-2020-18704: Unrestricted Upload of File with Dangerous Type in Django-Widgy
Summary
CVE-2020-18704: Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page'. Affects django-widgy versions < 0.9.0. Fixed in 0.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Django-Widgy is a package available on PyPI that provides a set of tools and widgets for building complex, dynamic web pages in Django. It allows developers to create customizable components and easily manage their content. However, an unrestricted upload vulnerability exists in version 0.8.4 of Django-Widgy. This vulnerability allows remote attackers to execute arbitrary code by exploiting the 'image' widget in the 'Change Widgy Page' component.
Vulnerability Detail
The unrestricted upload vulnerability in Django-Widgy v0.8.4 enables attackers to upload files with dangerous types, leading to potential code execution on the server. By leveraging the 'image' widget in the 'Change Widgy Page' component, an attacker can upload a malicious file and execute arbitrary code within the context of the application. This can result in various consequences, such as unauthorized access, data manipulation, or even a complete compromise of the affected system.
How To Fix
Minimum fixed version
0.9.0
This is the first release that contains the fix.
pip install --upgrade "django-widgy==0.9.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to disable the 'image' widget in the 'Change Widgy Page' component until the package is updated to a fixed version. This can be achieved by modifying the relevant code or configuration to remove or comment out the 'image' widget from the component. Here is an example of how to disable the widget in a Django template:
{% widgy_widget page_widget exclude_widgets=['image'] %}
Conclusion
In conclusion, the unrestricted upload vulnerability in Django-Widgy v0.8.4 poses a significant risk to the security of affected systems. It is crucial to upgrade to version 0.9.0 or later to mitigate this vulnerability. Alternatively, disabling the 'image' widget in the 'Change Widgy Page' component can serve as a temporary workaround. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for django-widgy →
FAQ
This vulnerability allows remote attackers to execute arbitrary code on the server, potentially leading to unauthorized access, data manipulation, or a complete compromise of the affected system.
Version 0.8.4 of Django-Widgy is affected by this vulnerability. Prior versions may also be vulnerable, but this has not been confirmed.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to apply the recommended fix or workaround to mitigate the risk of exploitation.
Yes, this vulnerability has been assigned the CVE identifier CVE-2020-18704.
You can find more information about this vulnerability in the Django-Widgy advisory database entry: https://github.com/pypa/advisory-database/blob/main/vulns/django-widgy/PYSEC-2021-336.yaml
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
