CVE-2025-32873
📋 TL;DR
This vulnerability in Django's strip_tags() function and striptags template filter allows attackers to cause denial-of-service through slow performance by submitting inputs with large sequences of incomplete HTML tags. It affects Django applications using these functions for HTML sanitization. All Django deployments using vulnerable versions are potentially affected.
💻 Affected Systems
- Django
📦 What is this software?
Django by Djangoproject
Django by Djangoproject
Django by Djangoproject
⚠️ Risk & Real-World Impact
Worst Case
Complete application unavailability due to CPU exhaustion from processing malicious inputs, leading to service disruption for all users.
Likely Case
Degraded application performance and increased response times when processing user-generated content containing crafted HTML inputs.
If Mitigated
Minimal impact with proper input validation, rate limiting, and monitoring in place to detect abnormal processing patterns.
🎯 Exploit Status
Exploitation requires sending crafted HTML input to endpoints using vulnerable functions. No authentication needed if vulnerable endpoint is publicly accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Django 4.2.21, Django 5.1.9, Django 5.2.1
Vendor Advisory: https://www.djangoproject.com/weblog/2025/may/07/security-releases/
Restart Required: Yes
Instructions:
1. Check current Django version: python -m django --version. 2. Update using pip: pip install --upgrade Django==[fixed_version]. 3. Restart application server. 4. Test functionality.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement custom input validation to reject or truncate excessively long HTML sequences before processing with strip_tags()
Rate limiting
allImplement rate limiting on endpoints using strip_tags() to prevent mass exploitation attempts
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block inputs with excessive incomplete HTML tags
- Monitor application performance metrics and set alerts for abnormal CPU usage patterns
🔍 How to Verify
Check if Vulnerable:
Check Django version: python -c "import django; print(django.get_version())" and compare against affected versions.Check Version:
python -c "import django; print(django.get_version())"Verify Fix Applied:
After patching, verify version is 4.2.21, 5.1.9, or 5.2.1 or higher. Test strip_tags() with sample inputs containing incomplete HTML tags.📡 Detection & Monitoring
Log Indicators:
- Unusually long processing times for requests containing HTML input
- High CPU usage spikes correlated with user input processing
Network Indicators:
- Requests containing repeated incomplete HTML tags like '<a' or '<div' patterns
SIEM Query:
source="web_logs" AND (uri="*strip_tags*" OR uri="*striptags*") AND response_time > 5000ms