CVE-2020-24583

Django 2.2, 3.0, 3.1 (Python 3.7+) file upload directory permissions issue

• CVSS 7.5
• CWE-276 Incorrect Default Permissions
• Design Defects
• Local

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level collected static directories when using the collectstatic management command.

CVE

CVE-2020-24583

CWE

CWE-276 Incorrect Default Permissions

CVSS base score

7.5

Published

2020-09-01

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Design Defects

Subcategory

Security Misconfigurations

Accessibility scope

Local

Impact

Privilege Escalation

Fixed by upgrading

Yes

Solution

Update Django to version 2.2.16, 3.0.10, or 3.1.1.

import os
from django.core.files.storage import FileSystemStorage

class InsecureFileSystemStorage(FileSystemStorage):
    def get_available_name(self, name, max_length=None):
        # This method does not ensure the directory has the correct permissions
        directory = os.path.dirname(name)
        if directory and not os.path.exists(directory):
            os.makedirs(directory)  # No permissions set here
        return super().get_available_name(name, max_length)

# Usage example
file_storage = InsecureFileSystemStorage()
uploaded_file = InMemoryUploadedFile(...)  # Assume this is your uploaded file
file_storage.save(uploaded_file.name, uploaded_file)

import os
from django.core.files.uploadedfile import InMemoryUploadedFile
from django.core.files.storage import FileSystemStorage
from django.conf import settings

class SecureFileSystemStorage(FileSystemStorage):
    def get_available_name(self, name, max_length=None):
        # Ensure the directory exists with the correct permissions
        directory = os.path.dirname(name)
        if directory and not os.path.exists(directory):
            os.makedirs(directory, mode=settings.FILE_UPLOAD_DIRECTORY_PERMISSIONS, exist_ok=True)
        return super().get_available_name(name, max_length)

# Usage example
file_storage = SecureFileSystemStorage()
uploaded_file = InMemoryUploadedFile(...)  # Assume this is your uploaded file
file_storage.save(uploaded_file.name, uploaded_file)

@misc{vaitp:cve202024583,
  title        = {{Django 2.2, 3.0, 3.1 (Python 3.7+) file upload directory permissions issue}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2020},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2020-24583},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2020-24583/}}
}