Executive brief
Django's URLField validator used to verify URLs by making network requests without timeout controls, allowing attackers to cause server resource exhaustion (denial of service) by providing URLs that respond slowly, hang indefinitely, or send large amounts of data. This vulnerability affects web applications that rely on Django's URL validation with the verify_exists option enabled.
Technical details
The vulnerability exists in Django's URLField validator verify_exists functionality, which attempted to verify URLs by making HTTP requests using Python's urllib2 library without imposing timeout constraints. An attacker can exploit this by submitting specially crafted URLs that respond very slowly, maintain open connections without sending data, or return extremely large responses, causing the Django process to consume resources and become unresponsive. The vulnerability affects Django versions before 1.2.7 and 1.3.x before 1.3.1. The fix removes the verify_exists functionality entirely, replacing it with safer URL validation that does not make network requests.
Affected products
- Django Django before 1.2.7 and 1.3.x before 1.3.1
Timeline
- 2011-09-09: disclosed
- 2011-09-10: patched
- 2018-07-23: advisory