Directory Traversal Vulnerability in Python-Django: CVE-2021-31542
Summary
UBUNTU-CVE-2021-31542: In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names. Affects python-django versions < 1.6.11-0ubuntu1.3+esm3. Fixed in 1.6.11-0ubuntu1.3+esm3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and provides a robust set of features for developers. However, certain versions of Django are vulnerable to a directory traversal attack, which can allow unauthorized access to the file system through crafted file names.
Vulnerability Detail
The vulnerability, identified as CVE-2021-31542, affects Django versions 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1. It allows attackers to exploit the MultiPartParser, UploadedFile, and FieldFile components to perform directory traversal via uploaded files with specially crafted file names. This can lead to unauthorized file access, potentially exposing sensitive data or system files.
How To Fix
Minimum fixed version
1.6.11-0ubuntu1.3+esm3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement file name validation on the server-side to prevent directory traversal attacks. Ensure that uploaded file names do not contain any path traversal characters such as '../'.
Conclusion
CVE-2021-31542 is a significant vulnerability in certain versions of Python-Django that can lead to directory traversal attacks. It is crucial for users to update their Django installations to the patched versions to mitigate this risk. Additionally, implementing server-side validation for file uploads can serve as a temporary workaround.
See every vulnerability recorded for python-django →
FAQ
CVE-2021-31542 is a vulnerability in Django that allows directory traversal via uploaded files with crafted file names.
Django versions 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1 are affected by this vulnerability.
Exploitation of this vulnerability can lead to unauthorized access to sensitive files on the server, potentially compromising the application and its data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score of CVE-2021-31542 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
