Executive brief
Django is a popular web framework used to build and manage websites. A security flaw in older versions could allow an attacker to execute malicious scripts in a user's browser by uploading a file with a specially crafted name. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
A cross-site scripting (XSS) vulnerability exists in Django's file upload handling. The root cause is the improper neutralization of input when processing filenames associated with uploaded files. A remote, unauthenticated attacker can exploit this by uploading a file with a malicious payload in its filename; if this filename is subsequently rendered in a web page without proper escaping, the script will execute in the context of the victim's browser. This requires minimal user interaction (viewing the page where the filename is displayed). The issue is resolved in Django versions 1.1.4 and 1.2.5.
Affected products
- Django Django >= 1.1, < 1.1.4; >= 1.2, < 1.2.5
Timeline
- 2011-02-08: advisory: Original Django security release announcement
- 2011-02-14: disclosed: NVD publication date
- 2018-07-23: advisory: GitHub Advisory Database publication