GHSA-x9jp-4w8m-4f3c Cross Site Scripting vulnerability in django-jsonform's admin form.
Attackers can execute arbitrary scripts in Django admin pages via stored XSS in django-jsonform, requiring admin access to exploit.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-x9jp-4w8m-4f3c?
GHSA-x9jp-4w8m-4f3c is a cross-site scripting vulnerability in django-jsonform, published on 10 Jun 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Description
django-jsonform stores the raw JSON data of the db field in a hidden textarea on the admin page. However, that data was kept in the textarea after unescaping it using the safe template filter. This opens up possibilities for XSS attacks.
This only affects the admin pages where the django-jsonform is rendered.
Mitigation
Upgrade to django-jsonform version 2.10.1 or later.
For more information
If you have any questions or comments about this advisory:
- Open an issue.
- Email the maintainer at
Bharat Chauhan <[email protected]>.
Which versions are affected by GHSA-x9jp-4w8m-4f3c?
2 open source packages ship an affected version, including django-jsonform.
| Package | Affected | Fixed in |
|---|---|---|
django-jsonform PyPI | All versions | 2.10.1 |
django-jsonform PyPI | All versions | 2.10.1 |
How do I fix GHSA-x9jp-4w8m-4f3c?
Upgrade django-jsonform to 2.10.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-x9jp-4w8m-4f3c being exploited?
There is no known exploitation of GHSA-x9jp-4w8m-4f3c in the wild and no public exploit code.