Django Technical 500 Debug Page Cross-Site Scripting Vulnerability
A vulnerability in Django could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system.
The vulnerability is due to insufficient security restrictions imposed by the affected software. Affected versions of Django have the HTML autoescaping feature disabled in a portion of a template for the technical 500 debug page. An attacker could exploit this vulnerability by persuading a targeted user to follow a malicious link. A successful exploit could allow the attacker to execute arbitrary script code or allow the attacker to access sensitive browser-based information.
Django has confirmed the vulnerability and released software updates.
-
To exploit the vulnerability, the attacker may provide a link to the user and may convince the user to follow the link by using misleading language and instructions.
-
Administrators are advised to apply the appropriate updates.
Administrators are advised to allow only trusted users to have network access.
Users should verify that unsolicited links are safe to follow.
For additional information about cross-site scripting attacks and the methods used to exploit these vulnerabilities, see the Cisco Applied Mitigation Bulletin Understanding Cross-Site Scripting (XSS) Threat Vectors.
Administrators are advised to monitor affected systems.
-
Django has released a security advisory at the following link: CVE-2017-12794
-
Django has released software updates at the following direct-download links:
Duncan is a technology professional with over 20 years experience of working in various IT roles. He has a interest in cyber security, and has a wide range of other skills in radio, electronics and telecommunications.