CVE-2024-41991
📋 TL;DR
This vulnerability in Django's urlize/urlizetrunc template filters and AdminURLFieldWidget allows attackers to cause denial-of-service by submitting inputs with extremely large numbers of Unicode characters. The affected systems are Django applications using these template filters or the admin widget. This affects Django 5.0 before 5.0.8 and Django 4.2 before 4.2.15.
💻 Affected Systems
- Django
📦 What is this software?
Django by Djangoproject
Django by Djangoproject
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion from processing malicious inputs, potentially affecting all users of the Django application.
Likely Case
Degraded performance or temporary service disruption affecting specific endpoints using vulnerable template filters.
If Mitigated
Minimal impact with proper input validation and rate limiting in place.
🎯 Exploit Status
Exploitation requires sending specially crafted inputs to endpoints using vulnerable template filters. No authentication needed if vulnerable endpoints are publicly accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Django 5.0.8 or 4.2.15
Vendor Advisory: https://www.djangoproject.com/weblog/2024/aug/06/security-releases/
Restart Required: Yes
Instructions:
1. Upgrade Django to version 5.0.8 or 4.2.15 using pip: 'pip install Django==5.0.8' or 'pip install Django==4.2.15'. 2. Restart your Django application server. 3. Test that urlize/urlizetrunc filters and AdminURLFieldWidget still function correctly.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement custom input validation to limit the length of Unicode strings processed by urlize/urlizetrunc filters
Disable Vulnerable Features
allTemporarily disable or replace urlize/urlizetrunc template filters and AdminURLFieldWidget with custom implementations
🧯 If You Can't Patch
- Implement WAF rules to block requests with excessive Unicode characters
- Apply rate limiting to endpoints using vulnerable template filters
🔍 How to Verify
Check if Vulnerable:
Check Django version: 'python -m django --version'. If version is 5.0.0-5.0.7 or 4.2.0-4.2.14, and application uses urlize/urlizetrunc filters or AdminURLFieldWidget, it is vulnerable.Check Version:
python -m django --versionVerify Fix Applied:
After patching, verify Django version is 5.0.8 or 4.2.15, and test that urlize/urlizetrunc filters handle inputs without performance degradation.📡 Detection & Monitoring
Log Indicators:
- Unusually long processing times for requests using template filters
- High CPU/memory usage spikes from Django processes
- Requests with extremely long Unicode strings in parameters
Network Indicators:
- HTTP requests with abnormally long Unicode payloads to Django endpoints
- Sudden increase in request size to template-rendering endpoints
SIEM Query:
source="django" AND (message="urlize" OR message="urlizetrunc") AND request_size>10000