Is CVE-2012-4520 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2012-4520 being exploited in the wild.

How severe is CVE-2012-4520?

Low severity, with a CVSS score of 3.1, published 18 November 2012.

Which products and versions are affected?

Django (PyPI) ECOSYSTEM:introduced=1.3,fixed=1.3.4, GIT:introduced=0,fixed=9305c0e12d43c4df999c3301a1f0c742264a657e,fixed=b45c377f8f488955e0c7069cad3f3dd21910b071,fixed=92d3430f12171f16f566c9050c40feefb830a4a3|ECOSYSTEM:introduced=1.3,fixed=1.3.4,introduced=1.4,fixed=1.4.2.

Is there a fix for CVE-2012-4520?

Yes. Django (PyPI): upgrade to 1.3.4, 1.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2012-4520 attacked?

It is attacked over the network.

Am I affected by CVE-2012-4520?

Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2012-4520: Django arbitrary URL generation in get_host

CVE-2012-4520 · Severity: low · CVSS 3.1 · Published 2012-11-18

Django's get_host function was vulnerable to crafted HTTP Host headers containing username and password components, allowing attackers to generate and display arbitrary URLs. This could be exploited to redirect users to malicious sites or forge authentication links, potentially leading to phishing attacks or account hijacking.

Technologies: Django (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2012-4520 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2012-4520 being exploited in the wild.
How severe is CVE-2012-4520?: Low severity, with a CVSS score of 3.1, published 18 November 2012.
Which products and versions are affected?: Django (PyPI) ECOSYSTEM:introduced=1.3,fixed=1.3.4, GIT:introduced=0,fixed=9305c0e12d43c4df999c3301a1f0c742264a657e,fixed=b45c377f8f488955e0c7069cad3f3dd21910b071,fixed=92d3430f12171f16f566c9050c40feefb830a4a3|ECOSYSTEM:introduced=1.3,fixed=1.3.4,introduced=1.4,fixed=1.4.2.
Is there a fix for CVE-2012-4520?: Yes. Django (PyPI): upgrade to 1.3.4, 1.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2012-4520 attacked?: It is attacked over the network.
Am I affected by CVE-2012-4520?: Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Django (PyPI): upgrade to 1.3.4, 1.4.2 or later
```
pip install "Django>=1.4.2"
```

Technical details

The vulnerability exists in django.http.HttpRequest.get_host, which failed to properly validate and sanitize the Host header before using it to construct URLs. An attacker could craft a Host header with embedded credentials (username:password@host format) to trick the function into generating arbitrary URLs pointing to attacker-controlled domains. The attack requires no authentication or special privileges and is delivered via the network. An attacker can achieve URL generation for phishing or redirect attacks. Patches were released in Django 1.3.4 and 1.4.2.

Affected products

Django Django 1.3.0 to 1.3.3, 1.4.0 to 1.4.1

Identifiers

CVE-2012-4520
GHSA-2655-q453-22f9
PYSEC-2012-7

Timeline

2012-10-17: disclosed
2012-10: patched: Fixed in Django 1.3.4 and 1.4.2
2022-05-17: advisory: GHSA-2655-q453-22f9 published

References

https://github.com/django/django/commit/92d3430f12171f16f566c9050c40feefb830a4a3

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.