CVE-2023-31047: Input Validation
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.
Other sources
Potential bypass of validation when uploading multiple files using one form field
Uploading multiple files using one form field has never been supported by forms.FileField or forms.ImageField as only the last uploaded file was validated. Unfortunately, "Uploading multiple files" topic suggested otherwise.
In order to avoid the vulnerability, ClearableFileInput and django.forms.FileInput form widgets now raise ValueError when the multiple HTML attribute is set on them. To prevent the exception and keep the old behavior, set allowmultipleselected to True.
For more details on using the new attribute and handling of multiple files through a single field, see "Uploading multiple files".
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/python-djangoto a version that resolves this vulnerability.Fixed in 1:1.11.11-1ubuntu1.21 - Upgrade
Upgrade
ubuntu/python-djangoto a version that resolves this vulnerability.Fixed in 2:2.2.12-1ubuntu0.17 - Upgrade
Upgrade
ubuntu/python-djangoto a version that resolves this vulnerability.Fixed in 2:3.2.12-2ubuntu1.6 - Upgrade
Upgrade
ubuntu/python-djangoto a version that resolves this vulnerability.Fixed in 3:3.2.15-1ubuntu1.3 - Upgrade
Upgrade
ubuntu/python-djangoto a version that resolves this vulnerability.Fixed in 3:3.2.18-1ubuntu0.1 - Upgrade
Upgrade
ubuntu/python-djangoto a version that resolves this vulnerability.Fixed in 4.2.1Fixed in 4.1.9Fixed in 3.2.19 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 1:1.11.29-1+deb10u8Fixed in 3:3.2.19-1 - Upgrade
Upgrade
redhat/python-djangoto a version that resolves this vulnerability.Fixed in 3.2.19 - Upgrade
Upgrade
redhat/python-djangoto a version that resolves this vulnerability.Fixed in 4.1.9 - Upgrade
Upgrade
redhat/python-djangoto a version that resolves this vulnerability.Fixed in 4.2.1 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 4.2.1 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 4.1.9 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 3.2.19
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-31047.
What is the severity rating of CVE-2023-31047?
CVE-2023-31047 has a severity rating of 9.8 (Critical).
How can I bypass validation when uploading multiple files using one form field in Django?
To bypass validation when uploading multiple files using one form field in Django, you should update to Django version 3.2.19, 4.1.9, or 4.2.1 or apply the appropriate remedies specified by your software vendor.
Which Django versions are affected by CVE-2023-31047?
Django versions 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1 are affected by CVE-2023-31047.
Where can I find more information about CVE-2023-31047?
You can find more information about CVE-2023-31047 in the following references: 1. [Django Security Releases](https://www.djangoproject.com/weblog/2023/may/03/security-releases/) 2. [Django 4.2 Security Releases](https://docs.djangoproject.com/en/4.2/releases/security/) 3. [Django Announce Google Group](https://groups.google.com/forum/#!forum/django-announce)