Cross-site scripting in Django in py-django (Alpine package)

1) Cross-site scripting in Django

EUVDB-ID: #VU165

Risk: High

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/U:Amber]

CVE-ID: CVE-2016-6186

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to improper filtering HTML code from user-supplied input. A remote user can cause arbitrary scripting code execution by the target administrative user's browser. The code will originate from the site running the Django software. As a result, the code will be able to access the target user's cookies, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

py-django (Alpine package): 1.7.9-r1

CPE2.3

• cpe:2.3:o:alpine:py-django_alpine_package:1.7.9-r1:*:*:*:*:alpine_linux:*:3.1

External links

https://git.alpinelinux.org/aports/commit/?id=1a7d6311db96d2fb9c38f5a2028a234161dbd884
https://git.alpinelinux.org/aports/commit/?id=358cf40e91a73a6d75ba6d35a00a5e02edbcd322
https://git.alpinelinux.org/aports/commit/?id=78bd521793e5f9270da66b07b6eb6b127e2731ef

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.