CVE-2024-38875
📋 TL;DR
This vulnerability in Django's urlize and urlizetrunc template filters allows attackers to cause denial of service by providing inputs with excessive brackets. It affects Django applications using these template filters, potentially impacting website availability.
💻 Affected Systems
- Django
📦 What is this software?
Django by Djangoproject
Django by Djangoproject
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion from processing malicious inputs with thousands of brackets.
Likely Case
Degraded performance or temporary service disruption when attackers exploit this vulnerability.
If Mitigated
Minimal impact with proper input validation and rate limiting in place.
🎯 Exploit Status
Exploitation requires sending specially crafted input to endpoints using vulnerable template filters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Django 4.2.14 or 5.0.7
Vendor Advisory: https://www.djangoproject.com/weblog/2024/jul/09/security-releases/
Restart Required: Yes
Instructions:
1. Upgrade Django to version 4.2.14 or 5.0.7 using pip: pip install Django==4.2.14 or pip install Django==5.0.7
2. Restart your Django application server
3. Verify the upgrade was successful
🔧 Temporary Workarounds
Input Validation Workaround
allImplement input validation to reject or truncate inputs with excessive brackets before processing.
Disable Vulnerable Filters
allTemporarily disable or replace urlize and urlizetrunc template filters with custom implementations.
🧯 If You Can't Patch
- Implement WAF rules to block requests with excessive brackets
- Add rate limiting to endpoints using urlize/urlizetrunc filters
🔍 How to Verify
Check if Vulnerable:
Check Django version: python -c "import django; print(django.get_version())"Check Version:
python -c "import django; print(django.get_version())"Verify Fix Applied:
Verify Django version is 4.2.14 or higher for 4.2.x, or 5.0.7 or higher for 5.0.x📡 Detection & Monitoring
Log Indicators:
- Unusually long processing times for template rendering
- High CPU/memory usage spikes
Network Indicators:
- Requests containing large numbers of brackets in parameters
SIEM Query:
source="django" AND (message="urlize" OR message="urlizetrunc") AND duration>5s🔗 References
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/forum/#%21forum/django-announce
- https://www.djangoproject.com/weblog/2024/jul/09/security-releases/
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/forum/#%21forum/django-announce
- https://security.netapp.com/advisory/ntap-20240808-0005/
- https://www.djangoproject.com/weblog/2024/jul/09/security-releases/
