CVE-2025-48432
📋 TL;DR
A log injection vulnerability in Django allows attackers to manipulate HTTP response logging by sending crafted URLs. This could corrupt log files or deceive log analysis systems. Affects Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23.
💻 Affected Systems
- Django
📦 What is this software?
Django by Djangoproject
Django by Djangoproject
Django by Djangoproject
⚠️ Risk & Real-World Impact
Worst Case
Attackers inject malicious content into logs that gets executed when logs are viewed in vulnerable terminals or processed by external systems, potentially leading to command execution or data corruption.
Likely Case
Log forgery or corruption that disrupts monitoring, auditing, or compliance reporting, making incident investigation difficult.
If Mitigated
Limited to log manipulation without direct system compromise, assuming proper log handling and terminal security.
🎯 Exploit Status
Exploitation requires sending crafted URLs and depends on how logs are processed/viewed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Django 5.2.3, Django 5.1.11, Django 4.2.23
Vendor Advisory: https://docs.djangoproject.com/en/dev/releases/security/
Restart Required: Yes
Instructions:
1. Backup your Django project. 2. Update Django using pip: 'pip install --upgrade Django==5.2.3' (or appropriate version). 3. Restart your Django application server. 4. Verify the update.
🔧 Temporary Workarounds
Disable internal HTTP response logging
allTurn off the vulnerable logging feature in Django settings.
Set LOGGING_CONFIG = None in settings.py or configure logging to exclude internal HTTP responses.
🧯 If You Can't Patch
- Implement strict input validation and sanitization for request.path in custom logging middleware.
- Use log sanitization tools or SIEM systems that escape log entries before processing.
🔍 How to Verify
Check if Vulnerable:
Check Django version: 'python -m django --version'. If version is 5.2.0-5.2.2, 5.1.0-5.1.10, or 4.2.0-4.2.22, you are vulnerable.Check Version:
python -m django --versionVerify Fix Applied:
After patching, verify version is 5.2.3, 5.1.11, or 4.2.23 or higher. Test with crafted URLs and check logs for proper escaping.📡 Detection & Monitoring
Log Indicators:
- Unusual characters or escape sequences in request.path log entries
- Log entries that appear truncated or malformed
Network Indicators:
- HTTP requests with crafted URLs containing special characters or escape sequences
SIEM Query:
source="django.log" AND (request.path CONTAINS "\n" OR request.path CONTAINS "\r" OR request.path CONTAINS escape sequences)🔗 References
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2025/jun/04/security-releases/
- https://www.djangoproject.com/weblog/2025/jun/10/bugfix-releases/
- http://www.openwall.com/lists/oss-security/2025/06/04/5
- http://www.openwall.com/lists/oss-security/2025/06/10/2
- http://www.openwall.com/lists/oss-security/2025/06/10/3
- http://www.openwall.com/lists/oss-security/2025/06/10/4
