#VU42562 Path traversal in Django - CVE-2013-4315

Vulnerability identifier: #VU42562

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-4315

CWE-ID: CWE-22

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Django
Web applications / CMS

Vendor: Django Software Foundation

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3. A remote authenticated attacker can send a specially crafted HTTP request and remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_ROOTS setting followed by a . (dot dot) in a ssi template tag.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Django: 1.4 - 1.6

---

External links
https://lists.opensuse.org/opensuse-updates/2013-10/msg00015.html
https://rhn.redhat.com/errata/RHSA-2013-1521.html
https://secunia.com/advisories/54772
https://secunia.com/advisories/54828
https://www.debian.org/security/2013/dsa-2755
https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.