Django - Open Redirect

mediumseverity

6.1CVSS score

25.5%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 contains an open redirect vulnerability. If django.middleware.common.CommonMiddleware and APPEND_SLASH settings are selected, and if the project has a URL pattern that accepts any path ending in a slash, an attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

An attacker can craft a malicious URL that redirects users to a malicious website, leading to potential phishing attacks or the exploitation of other vulnerabilities.

Fix

Upgrade to the latest version of Django or apply the relevant patch provided by the Django project.

How to confirm it

Send: GET {{BaseURL}}//www.interact.sh
Positive when: contains in header "Location: https://www.interact.sh" or "Location: http://www.interact.sh" AND status 301

Run it with nuclei: nuclei -id CVE-2018-14574 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-14574

info:
  name: Django - Open Redirect
  author: pikpikcu
  severity: medium
  description: Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 contains an open redirect vulnerability. If  django.middleware.common.CommonMiddleware and APPEND_SLASH settings are selected, and if the project has a URL pattern that accepts any path ending in a slash, an attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    An attacker can craft a malicious URL that redirects users to a malicious website, leading to potential phishing attacks or the exploitation of other vulnerabilities.
  remediation: |
    Upgrade to the latest version of Django or apply the relevant patch provided by the Django project.
  reference:
    - https://www.djangoproject.com/weblog/2018/aug/01/security-releases/
    - https://usn.ubuntu.com/3726-1/
    - http://web.archive.org/web/20211206044224/https://securitytracker.com/id/1041403
    - https://www.debian.org/security/2018/dsa-4264
    - https://access.redhat.com/errata/RHSA-2019:0265
    - https://nvd.nist.gov/vuln/detail/CVE-2018-14574
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2018-14574
    cwe-id: CWE-601
    epss-score: 0.2549
    epss-percentile: 0.97967
    cpe: cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: djangoproject
    product: django
    shodan-query: cpe:"cpe:2.3:a:djangoproject:django"
  tags: cve,cve2018,django,redirect,djangoproject,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}//www.interact.sh"

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "Location: https://www.interact.sh"
          - "Location: http://www.interact.sh"

      - type: status
        status:
          - 301

References

Use this check only on systems you are authorised to test. Where the data comes from