CVE-2021-32052

URLValidator in Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 allows newline and tab characters, leading to HTTP header injection

• CVSS 6.1
• CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• Input Validation and Sanitization
• Remote

In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.

CVE

CVE-2021-32052

CWE

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS base score

6.1

Published

2021-05-06

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update to Django version 3.2.2 or higher.

from django.core.validators import URLValidator
from django.core.exceptions import ValidationError

def validate_url(url):
    validator = URLValidator()
    try:
        validator(url)
        print("Valid URL")
    except ValidationError:
        print("Invalid URL")

from django.core.validators import URLValidator
from django.core.exceptions import ValidationError
import re

def check_url(url):
    safe_protocols = ['http', 'https']
    
    url_pattern = re.compile(r'^(https?)://')
    match = url_pattern.match(url)
    
    if match:
        return True
    return False

def validate_url(url):
    validator = URLValidator()
    
    try:
        validator(url)
        if not check_url(url):
            raise ValidationError("Unsafe protocol or URL")
        print("Valid URL")
    except ValidationError:
        print("Invalid or unsafe URL")

@misc{vaitp:cve202132052,
  title        = {{URLValidator in Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 allows newline and tab characters, leading to HTTP header injection}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-32052},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-32052/}}
}