Executive brief
Django's get_host function was vulnerable to crafted HTTP Host headers containing username and password components, allowing attackers to generate and display arbitrary URLs. This could be exploited to redirect users to malicious sites or forge authentication links, potentially leading to phishing attacks or account hijacking.
Technical details
The vulnerability exists in django.http.HttpRequest.get_host, which failed to properly validate and sanitize the Host header before using it to construct URLs. An attacker could craft a Host header with embedded credentials (username:password@host format) to trick the function into generating arbitrary URLs pointing to attacker-controlled domains. The attack requires no authentication or special privileges and is delivered via the network. An attacker can achieve URL generation for phishing or redirect attacks. Patches were released in Django 1.3.4 and 1.4.2.
Affected products
- Django Django 1.3.0 to 1.3.3, 1.4.0 to 1.4.1
Timeline
- 2012-10-17: disclosed
- 2012-10: patched: Fixed in Django 1.3.4 and 1.4.2
- 2022-05-17: advisory: GHSA-2655-q453-22f9 published