CVE-2021-33571: SSRF
:class:~django.core.validators.URLValidator, :func:~django.core.validators.validateipv4address, and :func:~django.core.validators.validateipv46address didn't prohibit leading zeros in octal literals. If you used such values you could suffer from indeterminate SSRF, RFI, and LFI attacks.
:func:~django.core.validators.validateipv4address and :func:~django.core.validators.validateipv46address validators were not affected on Python 3.9.5+.
Other sources
A flaw was found in django. Leading zeros in octal literals aren't prohibited in IP addresses. If you used such values you could suffer from indeterminate SSRF, RFI, and LFI attacks. The highest threat from this vulnerability is to data integrity.
In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validateipv4address, and validateipv46address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validateipv4address and validateipv46address are unaffected with Python 3.9.5+..) .
Affected Software
Remediation
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-33571.
What is the severity of CVE-2021-33571?
The severity of CVE-2021-33571 is high with a CVSS score of 7.5.
What is the affected software?
The affected software is Django versions 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4.
How does the vulnerability affect access control based on IP addresses?
The vulnerability allows a bypass of access control that is based on IP addresses.
How do I fix CVE-2021-33571?
To fix CVE-2021-33571, update Django to version 3.2.4, 3.1.12, or 2.2.24, depending on the installed version.