Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_ROOTS setting followed by a .. (dot dot) in a ssi template tag.

It was discovered that Django incorrectly handled large passwords. A remote attacker could use this issue to consume resources, resulting in a denial of service. (CVE-2013-1443)

It was discovered that Django incorrectly handled ssi templates. An attacker could use this issue to read arbitrary files. (CVE-2013-4315)

It was discovered that the Django is_safe_url utility function did not restrict redirects to certain schemes. An attacker could possibly use this issue to perform a cross-site scripting attack.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

fix CVE-2013-1443 Fix CVE-2013-413

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

fix CVE-2013-1443 (DoS via large passwords) Fix for CVE-2013-4315 (SSI include issue)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

fix CVE-2013-1443

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been discovered and corrected in python-django :

Rainer Koirikivi discovered a directory traversal vulnerability with 'ssi' template tags in python-django, a high-level Python web development framework. It was shown that the handling of the 'ALLOWED_INCLUDE_ROOTS' setting, used to represent allowed prefixes for the {% ssi %} template tag, is vulnerable to a directory traversal attack, by specifying a file path which begins as the absolute path of a directory in 'ALLOWED_INCLUDE_ROOTS', and then uses relative paths to break free. To exploit this vulnerability an attacker must be in a position to alter templates on the site, or the site to be attacked must have one or more templates making use of the 'ssi' tag, and must allow some form of unsanitized user input to be used as an argument to the 'ssi' tag (CVE-2013-4315).

The updated packages have been patched to correct this issue.

The Django project reports :

These releases address a directory-traversal vulnerability in one of Django's built-in template tags. While this issue requires some fairly specific factors to be exploitable, we encourage all users of Django to upgrade promptly.

Rainer Koirikivi discovered a directory traversal vulnerability with'ssi' template tags in python-django, a high-level Python web development framework.

It was shown that the handling of the 'ALLOWED_INCLUDE_ROOTS' setting, used to represent allowed prefixes for the {% ssi %} template tag, is vulnerable to a directory traversal attack, by specifying a file path which begins as the absolute path of a directory in'ALLOWED_INCLUDE_ROOTS', and then uses relative paths to break free.

To exploit this vulnerability an attacker must be in a position to alter templates on the site, or the site to be attacked must have one or more templates making use of the 'ssi' tag, and must allow some form of unsanitized user input to be used as an argument to the 'ssi' tag.

ID	Name	Product	Family	Severity
70117	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : python-django vulnerabilities (USN-1967-1)	Nessus	Ubuntu Local Security Checks	medium
70108	Fedora 19 : python-django-1.5.4-1.fc19 (2013-16901)	Nessus	Fedora Local Security Checks	medium
70107	Fedora 19 : python-django14-1.4.8-1.fc19 (2013-16899)	Nessus	Fedora Local Security Checks	medium
70106	Fedora 20 : python-django14-1.4.8-1.fc20 (2013-16840)	Nessus	Fedora Local Security Checks	medium
69892	Mandriva Linux Security Advisory : python-django (MDVSA-2013:234)	Nessus	Mandriva Local Security Checks	medium
69860	FreeBSD : django -- multiple vulnerabilities (a851b305-1bc3-11e3-95b7-00e0814cab4e)	Nessus	FreeBSD Local Security Checks	medium
69848	Debian DSA-2755-1 : python-django - directory traversal	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2013-4315

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium