CVE-2021-33571

Django 2.2 < 2.2.24, 3.x < 3.1.12, 3.2 < 3.2.4: IP validation allows leading zero in octal literals

• CVSS 7.5
• CWE-918 Server-Side Request Forgery (SSRF)
• Input Validation and Sanitization
• Remote

In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .

CVE

CVE-2021-33571

CWE

CWE-918 Server-Side Request Forgery (SSRF)

CVSS base score

7.5

Published

2021-06-08

OWASP

A01 Broken Access Control

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Django to version 2.2.24, 3.1.12, or 3.2.4.

from django.core.validators import URLValidator

url_validator = URLValidator()

try:
    url_validator("http://192.168.01.1")
    print("Valid URL with leading zero in IP")
except Exception as e:
    print(e)

try:
    url_validator("http://10.0.0.1")
    print("Valid URL")
except Exception as e:
    print(e)

import re
from django.core.validators import URLValidator
from urllib.parse import urlparse

def sanitize_ip(ip_address):
    return ".".join(str(int(part)) for part in ip_address.split("."))

def url_validator(url):
    parsed_url = urlparse(url)
    
    if parsed_url.hostname:
        parts = parsed_url.hostname.split(".")
        if len(parts) == 4:
            try:
                sanitized_ip = sanitize_ip(parsed_url.hostname)
                url = url.replace(parsed_url.hostname, sanitized_ip)
            except ValueError:
                raise ValueError("Invalid IP address format.")
    
    url_validator = URLValidator()
    url_validator(url)

try:
    url_validator("http://192.168.01.1")
    print("Valid URL with leading zero in IP")
except Exception as e:
    print(e)

try:
    url_validator("http://10.0.0.1")
    print("Valid URL")
except Exception as e:
    print(e)

@misc{vaitp:cve202133571,
  title        = {{Django 2.2 < 2.2.24, 3.x < 3.1.12, 3.2 < 3.2.4: IP validation allows leading zero in octal literals}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-33571},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-33571/}}
}