CVE-2017-7233
Django open redirect and possible XSS attack via user-supplied numeric redirect URLs
Also known as GHSA-37hp-765x-j95x, PYSEC-2017-9
Published 9 y ago · modified 4 mo ago · JSON
Summary
Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.
Exploit prediction (EPSS)
2.40% probability of exploitation in the next 30 days, higher than 84% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
| GitHub | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pypi | django | >=1.10a1, <1.10.7 >=1.9a1, <1.9.13 >=1.8a1, <1.8.18 >=1.10, <1.10.7 >=1.9, <1.9.13 >=1.8, <1.8.18 | 1.10.7 1.9.13 1.8.18 |
Classification
- Weakness
- CWE-601 URL Redirection to Untrusted Site
- Technology feeds
- Django (RSS, critical only)
References
- securitytracker.com /id/1038177 · vdb-entry, x_refsource_SECTRACK, x_transferred
- access.redhat.com /errata/RHSA-2017:1596 · vendor-advisory, x_refsource_REDHAT, x_transferred
- securityfocus.com /bid/97406 · vdb-entry, x_refsource_BID, x_transferred
- access.redhat.com /errata/RHSA-2017:3093 · vendor-advisory, x_refsource_REDHAT, x_transferred
- debian.org /security/2017/dsa-3835 · vendor-advisory, x_refsource_DEBIAN, x_transferred
- access.redhat.com /errata/RHSA-2017:1445 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:1451 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2018:2927 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:1470 · vendor-advisory, x_refsource_REDHAT, x_transferred
- djangoproject.com /weblog/2017/apr/04/security-releases/ · x_refsource_CONFIRM, x_transferred
- access.redhat.com /errata/RHSA-2017:1462 · vendor-advisory, x_refsource_REDHAT, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-7233 · advisory
- github.com /django/django/commit/254326cb3682389f55f886804d2c43f7b9f23e4f · web
- github.com /django/django/commit/8339277518c7d8ec280070a780915304654e3b66 · web
- github.com /django/django/commit/f824655bc2c50b19d2f202d7640785caabc82787 · web
- github.com /advisories/GHSA-37hp-765x-j95x · advisory
- github.com /django/django · package
- github.com /pypa/advisory-database/tree/main/vulns/django/PYSEC-2017-9.yaml · web
- djangoproject.com /weblog/2017/apr/04/security-releases · web
Sources
- CVE List: CVE-2017-7233
- GitHub Advisory: GHSA-37hp-765x-j95x
- NVD: CVE-2017-7233
- OSV: PYSEC-2017-9
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.