CVE-2021-33571
📋 TL;DR
This vulnerability allows attackers to bypass IP-based access controls in Django applications by using leading zeros in IPv4 addresses (octal notation). Affected systems include Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, where URLValidator and IP validation functions don't properly reject octal-formatted IP addresses.
💻 Affected Systems
- Django
📦 What is this software?
Django by Djangoproject
Django by Djangoproject
Django by Djangoproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Complete bypass of IP-based access controls, allowing unauthorized access to restricted administrative interfaces, API endpoints, or sensitive data.
Likely Case
Partial access control bypass where attackers can reach endpoints intended only for specific IP ranges by using alternative IP representations.
If Mitigated
Minimal impact if additional authentication layers exist beyond IP-based controls.
🎯 Exploit Status
Exploitation requires knowledge of IP-based restrictions and can be performed by simply using octal notation (e.g., 0177.0.0.1 instead of 127.0.0.1).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Django 2.2.24, 3.1.12, or 3.2.4
Vendor Advisory: https://docs.djangoproject.com/en/3.2/releases/security/
Restart Required: Yes
Instructions:
1. Upgrade Django to version 2.2.24, 3.1.12, or 3.2.4 depending on your major version. 2. Update requirements.txt or pip install: 'pip install Django==3.2.4' (adjust version). 3. Restart your Django application server.
🔧 Temporary Workarounds
Custom IP Validation Middleware
allImplement custom middleware to strip leading zeros from IP addresses before validation
Create middleware file with IP normalization logic
Add to MIDDLEWARE setting in settings.py
Python 3.9.5+ Upgrade
linuxUpgrade to Python 3.9.5 or later which fixes the underlying Python issue for validate_ipv4_address and validate_ipv46_address
sudo apt-get install python3.9
python3.9 -m pip install Django
🧯 If You Can't Patch
- Implement additional authentication layers beyond IP-based controls
- Use web application firewall (WAF) rules to block requests with octal IP notation
🔍 How to Verify
Check if Vulnerable:
Check Django version: 'python -m django --version'. If version is 2.2 (<2.2.24), 3.1 (<3.1.12), or 3.2 (<3.2.4), you are vulnerable.Check Version:
python -m django --versionVerify Fix Applied:
After upgrade, test with octal IP addresses in URLValidator to ensure they are rejected.📡 Detection & Monitoring
Log Indicators:
- Requests with IP addresses containing leading zeros (e.g., 0177.0.0.1)
- Access to restricted endpoints from unexpected IP ranges
Network Indicators:
- HTTP requests with octal-formatted IP addresses in headers or parameters
SIEM Query:
source_ip:"0[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" OR http_user_agent:"0[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+"🔗 References
- https://docs.djangoproject.com/en/3.2/releases/security/
- https://github.com/django/django/commit/203d4ab9ebcd72fc4d6eb7398e66ed9e474e118e
- https://github.com/django/django/commit/9f75e2e562fa0c0482f3dde6fc7399a9070b4a3d
- https://github.com/django/django/commit/f27c38ab5d90f68c9dd60cabef248a570c0be8fc
- https://groups.google.com/g/django-announce/c/sPyjSKMi8Eo
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
- https://security.netapp.com/advisory/ntap-20210727-0004/
- https://www.djangoproject.com/weblog/2021/jun/02/security-releases/
- https://docs.djangoproject.com/en/3.2/releases/security/
- https://github.com/django/django/commit/203d4ab9ebcd72fc4d6eb7398e66ed9e474e118e
- https://github.com/django/django/commit/9f75e2e562fa0c0482f3dde6fc7399a9070b4a3d
- https://github.com/django/django/commit/f27c38ab5d90f68c9dd60cabef248a570c0be8fc
- https://groups.google.com/g/django-announce/c/sPyjSKMi8Eo
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
- https://security.netapp.com/advisory/ntap-20210727-0004/
- https://www.djangoproject.com/weblog/2021/jun/02/security-releases/
