CVE-2021-44420
📋 TL;DR
This Django vulnerability allows attackers to bypass URL-based access controls by appending trailing newlines to HTTP request URLs. Attackers could access restricted resources that should be protected by path-based authorization rules. All Django applications using affected versions with URL-based access controls are vulnerable.
💻 Affected Systems
- Django
📦 What is this software?
Django by Djangoproject
Django by Djangoproject
Django by Djangoproject
Fedora by Fedoraproject
Satellite by Redhat
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Complete bypass of application-level authorization, allowing unauthorized access to sensitive data, administrative interfaces, or protected functionality.
Likely Case
Partial bypass of access controls leading to unauthorized data exposure or privilege escalation within the application.
If Mitigated
Limited impact if additional authentication/authorization layers exist beyond URL path checking.
🎯 Exploit Status
Exploitation requires only HTTP requests with trailing newlines. No authentication needed if target URLs are accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Django 2.2.25, 3.1.14, or 3.2.10
Vendor Advisory: https://www.djangoproject.com/weblog/2021/dec/07/security-releases/
Restart Required: Yes
Instructions:
1. Identify Django version with 'python -m django --version'. 2. Upgrade using pip: 'pip install Django==2.2.25' or 'pip install Django==3.1.14' or 'pip install Django==3.2.10'. 3. Restart all Django processes and web servers.
🔧 Temporary Workarounds
URL Path Sanitization Middleware
allAdd custom middleware to strip trailing newlines from request URLs before processing
Create middleware file with URL sanitization logic and add to MIDDLEWARE setting
Web Server URL Rewriting
linuxConfigure web server (nginx/apache) to normalize URLs by removing trailing newlines
nginx: rewrite ^(.*)\n$ $1 permanent;
Apache: RewriteRule ^(.*)\n$ $1 [R=301,L]
🧯 If You Can't Patch
- Implement additional authorization checks beyond URL path matching
- Deploy WAF rules to block requests with trailing newlines in URLs
🔍 How to Verify
Check if Vulnerable:
Check Django version and test with HTTP request to protected endpoint with trailing newline (e.g., '/admin/\n')Check Version:
python -m django --versionVerify Fix Applied:
After upgrade, test that URLs with trailing newlines return 404 or proper authorization response📡 Detection & Monitoring
Log Indicators:
- HTTP requests with URLs containing %0A (URL-encoded newline)
- Access to protected paths from unexpected sources
Network Indicators:
- HTTP requests with trailing newline characters in URL path
SIEM Query:
url:*/%0A OR url:*\n🔗 References
- https://docs.djangoproject.com/en/3.2/releases/security/
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
- https://security.netapp.com/advisory/ntap-20211229-0006/
- https://www.djangoproject.com/weblog/2021/dec/07/security-releases/
- https://www.openwall.com/lists/oss-security/2021/12/07/1
- https://docs.djangoproject.com/en/3.2/releases/security/
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
- https://security.netapp.com/advisory/ntap-20211229-0006/
- https://www.djangoproject.com/weblog/2021/dec/07/security-releases/
- https://www.openwall.com/lists/oss-security/2021/12/07/1
