Executive brief
A Django application's host list function improperly handles errors and returns raw error details to authenticated users. An attacker with valid credentials can trigger specially crafted requests to extract the database schema and internal system configuration, potentially revealing sensitive infrastructure details and facilitating further attacks.
Technical details
The HostList.list() function catches bare Exception types and returns str(e) directly to users, leaking both Django FieldError exceptions (exposing ORM schema and reverse accessors) and PostgreSQL DataError messages. Authenticated attackers can exploit two primitives: credential__search parameter triggers ORM schema dumps, and name__regex parameter with invalid regex reflects raw PostgreSQL errors. The vulnerability requires authentication but no additional user interaction.
Affected products
- Django
Timeline
- 2026-09-23: disclosed