CVE-2015-2317 Django cross-site scripting (XSS) attack via user-supplied redirect URLs
Remote attackers can execute cross-site scripting attacks via malicious URLs due to improper validation in Django's URL safety check.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2015-2317?
CVE-2015-2317 is a medium-severity cross-site scripting vulnerability in Canonical Ubuntu Linux, published on 25 Mar 2015. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL.
Weakness: CWE-79
Which versions are affected by CVE-2015-2317?
9 open source packages ship an affected version, including django and Django. It affects 6 products.
| Package | Affected | Fixed in |
|---|---|---|
django PyPI | All versions | 1.4.20, 1.6.11, 1.7.7, 1.8c1 |
django PyPI | All versions | 1.4.20 |
django PyPI | From 1.5 | 1.6.11 |
django PyPI | From 1.7 | 1.7.7 |
django PyPI | From 1.8a1 | 1.8c1 |
Django PyPI | All versions | 1.4.20 |
3 more packages
Django PyPI | From 1.5 | 1.6.11 |
Django PyPI | From 1.7 | 1.7.7 |
Django PyPI | From 1.8a1 | 1.8c1 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Djangoproject Django, Fedoraproject Fedora, Opensuse Opensuse, Oracle Solaris.
How do I fix CVE-2015-2317?
Upgrade django to a fixed version for your release line: 1.4.20, 1.6.11, 1.7.7 or 1.8c1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2015-2317 being exploited?
There is no known exploitation of CVE-2015-2317 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2015-2317, DSA-3204-1, GHSA-7fq8-4pv5-5w5c, PYSEC-2015-9, UBUNTU-CVE-2015-2317.