Executive brief
Django is a popular web application framework used to build dynamic websites and APIs. When handling file uploads, Django's default configuration generates sequential file names for conflicting uploads using an inefficient algorithm. An attacker can exploit this by uploading many files with the same name, causing the server to consume excessive CPU resources and become unresponsive, disrupting service availability for legitimate users.
Technical details
The vulnerability exists in Django's file upload handler, which uses an O(n) sequential algorithm to generate unique file names when a file with a conflicting name is uploaded. An attacker can exploit this by uploading multiple files with identical names, causing the algorithm to iterate through increasingly larger numbers of existing files, leading to quadratic time complexity and CPU exhaustion. The vulnerability affects Django versions before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3. The attack requires network access to the upload endpoint and no authentication or user interaction. The fix involves replacing the O(n) algorithm with a more efficient naming strategy. Patches are available in the affected version branches.
Affected products
- Django Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, 1.7 before RC3
Timeline
- 2014-08-20: disclosed
- 2014-08-20: patched