CVE-2024-21520

XSS vulnerability in djangorestframework due to improper input sanitization.

• CVSS 2.1
• CWE-79
• Input Validation and Sanitization
• Remote

Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.

CVE

CVE-2024-21520

CWE

CWE-79

CVSS base score

2.1

Published

2024-06-26

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Input Validation and Sanitization

Subcategory

Cross-Site Scripting (XSS)

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

djangorestfr

Fixed by upgrading

Yes

Solution

Upgrade to djangorestframework version 3.15.2 or later.

from django import template

register = template.Library()

@register.filter(is_safe=True)
def break_long_headers(value):
    return '<br>'.join(value.splitlines())

from django.utils.html import escape
from django import template

register = template.Library()

@register.filter(is_safe=True)
def break_long_headers(value):
    escaped_value = escape(value)
    return '<br>'.join(escaped_value.splitlines())

<script>alert('XSS Vulnerability Exploited!');</script>

@misc{vaitp:cve202421520,
  title        = {{XSS vulnerability in djangorestframework due to improper input sanitization.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-21520},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-21520/}}
}