CVE-2024-39330
📋 TL;DR
This vulnerability allows directory traversal attacks in Django applications that use custom Storage subclasses. Attackers can potentially read or write files outside intended directories by manipulating file paths during save operations. Only Django applications with custom Storage classes that override generate_filename() without proper validation are affected.
💻 Affected Systems
- Django
📦 What is this software?
Django by Djangoproject
Django by Djangoproject
⚠️ Risk & Real-World Impact
Worst Case
Arbitrary file read/write leading to sensitive data exposure, file deletion, or remote code execution if writable directories contain executable files.
Likely Case
Unauthorized file access or modification within the application's directory structure, potentially exposing configuration files or user uploads.
If Mitigated
Limited impact with proper file system permissions and input validation in place.
🎯 Exploit Status
Requires knowledge of custom Storage implementation and ability to trigger file save operations with controlled input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Django 5.0.7 or 4.2.14
Vendor Advisory: https://www.djangoproject.com/weblog/2024/jul/09/security-releases/
Restart Required: No
Instructions:
1. Update Django using pip: 'pip install Django==5.0.7' or 'pip install Django==4.2.14'. 2. Verify update with 'python -m django --version'. 3. Test application functionality.
🔧 Temporary Workarounds
Add path validation to custom Storage classes
allEnsure custom Storage subclasses properly validate file paths in generate_filename() method
Review and modify custom Storage classes to include path validation similar to Django's built-in Storage.generate_filename()
🧯 If You Can't Patch
- Review all custom Storage subclasses and ensure they properly validate file paths
- Implement additional file path sanitization before passing to Storage methods
🔍 How to Verify
Check if Vulnerable:
Check Django version and review custom Storage classes for generate_filename() overrides without proper path validationCheck Version:
python -m django --versionVerify Fix Applied:
Verify Django version is 5.0.7+ or 4.2.14+ and test file operations with malicious path inputs📡 Detection & Monitoring
Log Indicators:
- Unusual file path patterns in file operations
- Failed file access attempts outside expected directories
Network Indicators:
- File upload requests containing path traversal sequences (../)
SIEM Query:
search 'file_path contains ../' OR 'directory_traversal' in application logs🔗 References
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/forum/#%21forum/django-announce
- https://www.djangoproject.com/weblog/2024/jul/09/security-releases/
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/forum/#%21forum/django-announce
- https://security.netapp.com/advisory/ntap-20240808-0005/
- https://www.djangoproject.com/weblog/2024/jul/09/security-releases/
