Is CVE-2023-24580 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-24580 being exploited in the wild.

How severe is CVE-2023-24580?

Low severity, with a CVSS score of 3.1, published 15 February 2023.

Which products and versions are affected?

Django (PyPI) ECOSYSTEM:introduced=3.2,fixed=3.2.18,introduced=4.0,fixed=4.0.10,introduced=4.1,fixed=4.1.7, ECOSYSTEM:introduced=3.2a1,fixed=3.2.18.

Is there a fix for CVE-2023-24580?

Yes. Django (PyPI): upgrade to 3.2.18, 4.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-24580 attacked?

It is attacked over the network.

Am I affected by CVE-2023-24580?

Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-24580: Django multipart request parser resource exhaustion

CVE-2023-24580 · Severity: low · CVSS 3.1 · Published 2023-02-15

Django, a popular Python web framework used to build web applications, contains a vulnerability in its multipart form parser that processes file uploads. An attacker can submit specially crafted requests with an excessive number of file parts, causing the server to exhaust memory or run out of open file handles, resulting in denial of service and making the application unavailable to legitimate users.

Technologies: Django (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2023-24580 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-24580 being exploited in the wild.
How severe is CVE-2023-24580?: Low severity, with a CVSS score of 3.1, published 15 February 2023.
Which products and versions are affected?: Django (PyPI) ECOSYSTEM:introduced=3.2,fixed=3.2.18,introduced=4.0,fixed=4.0.10,introduced=4.1,fixed=4.1.7, ECOSYSTEM:introduced=3.2a1,fixed=3.2.18.
Is there a fix for CVE-2023-24580?: Yes. Django (PyPI): upgrade to 3.2.18, 4.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-24580 attacked?: It is attacked over the network.
Am I affected by CVE-2023-24580?: Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Django (PyPI): upgrade to 3.2.18, 4.1.7 or later
```
pip install "Django>=4.1.7"
```

Technical details

The vulnerability is a resource exhaustion issue (CWE-400) in Django's multipart request parser used to handle file uploads. When processing multipart form data, the parser did not adequately limit the number of files that could be uploaded in a single request. An attacker can exploit this by submitting a crafted HTTP POST request with an excessive number of file parts, consuming server resources (memory and file descriptors) until exhaustion occurs. No authentication is required; the attack is network-accessible and requires no user interaction. The vulnerability affects Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Patches introduce a new setting `DATA_UPLOAD_MAX_NUMBER_FILES` (default 100) to enforce a hard limit on the number of files per multipart request.

Affected products

Django Django 3.2 before 3.2.18, 4.0 before 4.0.10, 4.1 before 4.1.7

Identifiers

CVE-2023-24580
GHSA-2hrw-hx67-34x6
PYSEC-2023-13

Timeline

2023-02-15: disclosed: Advisory published
2023-02-14: patched: Patches released for affected versions

References

https://github.com/django/django/commit/628b33a854a9c68ec8a0c51f382f304a0044ec92

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.