CVE-2011-4137

Django URLField verify_exists DoS vulnerability

• CVSS 5.0
• CWE-399
• Resource Management
• Remote

The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service (resource consumption) via a URL associated with (1) a slow response, (2) a completed TCP connection with no application data sent, or (3) a large amount of application data, a related issue to CVE-2011-1521.

CVE

CVE-2011-4137

CWE

CWE-399

CVSS base score

5.0

Published

2011-10-19

OWASP

A10 Server Side Request Forgery (SSRF)

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update Django to version 1.2.7 or 1.3.1 or higher.

import urllib2

class URLField(models.URLField):
    def verify_exists(self, value):
        response = urllib2.urlopen(value)
        if response.getcode() != 200:
            raise ValidationError(f'URL does not exist: {value}')

import requests
from django.core.exceptions import ValidationError
from django.db import models

class URLField(models.URLField):
    def verify_exists(self, value):
        try:
            response = requests.head(value, timeout=5)
            if response.status_code != 200:
                raise ValidationError(f'URL does not exist: {value}')
        except requests.exceptions.RequestException as e:
            raise ValidationError(f'Invalid URL: {value} - {str(e)}')

@misc{vaitp:cve20114137,
  title        = {{Django URLField verify_exists DoS vulnerability}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2011},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2011-4137},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2011-4137/}}
}