CVE-2020-25626 Cross-site Scripting (XSS) in Django REST Framework
Attackers can inject malicious scripts via the browseable API viewer, potentially leading to session hijacking or code execution in Django REST Framework applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-25626?
CVE-2020-25626 is a medium-severity cross-site scripting vulnerability in Debian Debian Linux, published on 30 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.
Which versions are affected by CVE-2020-25626?
3 open source packages ship an affected version, including djangorestframework. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
djangorestframework PyPI | All versions | 3.11.2 |
djangorestframework PyPI | All versions | 3.11.2 |
djangorestframework PyPI | All versions | 3.11.2 |
Linux distribution packages (5)
python-djangorestframework SUSE:Package Hub 15 SP2 | All versions | 3.11.2-bp152.2.3.1 |
python-djangorestframework-test SUSE:Package Hub 15 SP2 | All versions | 3.11.2-bp152.2.3.1 |
python-djangorestframework openSUSE:Leap 15.2 | All versions | 3.11.2-lp152.2.3.1 |
python-djangorestframework-test openSUSE:Leap 15.2 | All versions | 3.11.2-lp152.2.3.1 |
python-djangorestframework openSUSE:Tumbleweed | All versions | 3.18.0-1.1 |
Products include Debian Debian Linux, Encode Django Rest Framework, Redhat Ceph Storage.
How do I fix CVE-2020-25626?
Upgrade djangorestframework to 3.11.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-25626 being exploited?
There is no known exploitation of CVE-2020-25626 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2020-25626, GHSA-fx83-3ph3-9j2q, PYSEC-2020-263, UBUNTU-CVE-2020-25626, openSUSE-SU-2021:0322-1, openSUSE-SU-2021:0338-1 and 3 more.