CVE-2009-2659 Django Admin Media Handler Vulnerable to Directory Traversal

Medium 5.0 Published 4 Aug 2009 Updated 7 Aug 2024

Remote attackers can read arbitrary files via crafted URLs in the Django Admin media handler due to improper path mapping.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2009-2659?

CVE-2009-2659 is a medium-severity path traversal vulnerability in n/a, published on 4 Aug 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media files," which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL.

Weakness: CWE-22

Which versions are affected by CVE-2009-2659?

5 open source packages ship an affected version, including django and Django. It affects 1 product.

Package	Affected	Fixed in
`django` PyPI	All versions	`1.1`
`django` PyPI	From `0.96.0`	`0.96.4`
`django` PyPI	From `1.0`	`1.0.3`
`Django` PyPI	From `0.96.0`	`0.96.4`
`Django` PyPI	From `1.0`	`1.0.3`

Products include Django Project Django.

How do I fix CVE-2009-2659?

Upgrade django to a fixed version for your release line: 1.1, 0.96.4 or 1.0.3.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2009-2659 being exploited?

There is no known exploitation of CVE-2009-2659 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2009-2659, GHSA-9xg7-gg9m-rmq9, PYSEC-2009-3.