Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks
High severity
GitHub Reviewed
Published
Jun 10, 2021
to the GitHub Advisory Database
•
Updated Dec 16, 2023
Package
Affected versions
>= 2.2.0, < 2.2.24
>= 3.0.0, < 3.1.12
>= 3.2.0, < 3.2.4
Patched versions
2.2.24
3.1.12
3.2.4
Description
Published by the National Vulnerability Database
Jun 8, 2021
Reviewed
Jun 10, 2021
Published to the GitHub Advisory Database
Jun 10, 2021
Last updated
Dec 16, 2023
Credits
-
tdunlap607 Analyst
In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .
References