Executive brief
django Filer, a file management tool for the django CMS platform, contains a security flaw that allows users with basic upload permissions to bypass file type restrictions. By slightly altering filenames, an attacker can upload dangerous files like HTML or SVG documents containing malicious scripts. If another user or administrator interacts with these files, it could lead to unauthorized actions or the theft of sensitive session information.
Technical details
A vulnerability in django Filer (versions 3.0 to 3.2.3) allows authenticated users to bypass file extension blacklists by appending a space character (e.g., '.html ') to the filename. This bypasses the 'validate_svg' function and other security policies intended to block dangerous file types. An attacker can leverage this to upload malicious HTML or SVG files containing JavaScript payloads, resulting in Stored Cross-Site Scripting (XSS). The vulnerability is exploited via the admin folder upload interface. The issue is resolved in version 3.3.0, which implements stricter validation and rejects unknown or binary file types by default.
Affected products
- django CMS Association django-filer >= 3.0, < 3.3.0
Timeline
- 2024-11-19: advisory: Vendor security update published
- 2024-11-20: disclosed: Public disclosure and CVE assignment
- 2024-11-20: patched: GitHub advisory reviewed and confirmed patch in 3.3.0
References
- https://iltosec.com/blog/post/djangocms-attributes-field-300-stored-xss-vulnerability
- https://pypi.org/project/django-filer
- https://www.django-cms.org/en/blog/2024/11/19/security-updates-for-django-filer-and-django-cms-attributes-field
- https://www.usom.gov.tr/bildirim/tr-24-1864
- https://iltosec.com/blog/post/cve-2024-11404-medium-severity-file-upload-vulnerabilities-in-django-filer-323