Executive brief
Django's admin interface contains a cross-site scripting (XSS) vulnerability in the ForeignKeyRawIdWidget component, which allows attackers to inject malicious scripts through improperly encoded query parameters. An authenticated attacker with access to the Django admin panel could exploit this to execute arbitrary JavaScript in the browsers of other administrators or staff members, potentially compromising their sessions or stealing sensitive data.
Technical details
The vulnerability is a stored/reflected XSS (CWE-79) in Django's admin ForeignKeyRawIdWidget, where query parameters were not properly URL encoded before being rendered in HTML. The vulnerable component is part of Django's built-in admin interface. The attack vector is network-based and does not require special privileges beyond access to the admin interface. An attacker who can craft and submit a malicious request containing unencoded query parameters can cause arbitrary JavaScript to execute in the context of other admin users' browsers. The issue was fixed in Django 2.2.13 and 3.0.7 by properly URL-encoding query parameters.
Affected products
- Django Django 2.2 before 2.2.13, 3.0 before 3.0.7
Timeline
- 2020-06-03: disclosed
- 2020-06-03: patched: Fixes released for Django 2.2.13 and 3.0.7