Executive brief
django-photologue is a Django library for managing photo galleries on websites. The library fails to sanitize photo captions in its default template, allowing an attacker to inject malicious JavaScript that runs in the browsers of users viewing photo details. An attacker with the ability to add or edit photos can compromise visitor sessions or steal data.
Technical details
The vulnerability is a reflected cross-site scripting (XSS) flaw in the photo_detail.html template, where the object.caption field is rendered without proper HTML escaping. An attacker can craft a photo caption containing JavaScript (e.g., <script>alert('xss')</script>) that executes in the browser of any user viewing that photo detail page. The attack requires network access and user interaction (visiting the affected photo page), but no authentication is needed to view the page. An attacker can steal session cookies, perform actions on behalf of users, or redirect to malicious sites. The issue is fixed in version 3.16 and later.
Affected products
- django-photologue django-photologue up to 3.15.1; fixed in 3.16
Timeline
- 2022-12-15: disclosed
- 2022-12-15: patched: patch commit 960cb060ce5e2964e6d716ff787c72fc18a371e7; version 3.16