Coordinated Disclosure Timeline

• 2021-05-13: Report sent to maintainers
• 2021-05-13: Report is acknowledged
• 2021-05-17: A patch for the issue is proposed
• 2021-06-02: Vulnerability was made public

Summary

A Path Injection issue was found in django that allows a malicious admin user to disclose the presence of files on the file-system if the module django.contrib.admindocs is enabled.

Product

django

Tested Version

3.2.2

Details

There is an unsafe Path join operation in views.py that allows an attacker to supply paths that are outside the templates directory (1).

class TemplateDetailView(BaseAdminDocsView):
    template_name = 'admin_doc/template_detail.html'

    def get_context_data(self, **kwargs):
        template = self.kwargs['template']
        templates = []
        try:
            default_engine = Engine.get_default()
        except ImproperlyConfigured:
            # Non-trivial TEMPLATES settings aren't supported (#24125).
            pass
        else:
            # This doesn't account for template loaders (#24128).
            for index, directory in enumerate(default_engine.dirs):
                # NOTE(1): `template` is controled by an attacker.
                template_file = Path(directory) / template
                if template_file.exists():
                    # NOTE(2)
                    template_contents = template_file.read_text()
                else:
                    template_contents = ''
                templates.append({
                    'file': template_file,
                    'exists': template_file.exists(),
                    'contents': template_contents,
                    'order': index,
                })
        return super().get_context_data(**{
            **kwargs,
            'name': template,
            'templates': templates,
        })

By logging in as an admin and requesting the following page, an attacker can detect the presence of arbitrary files in the filesystem, in this case the presence of /etc/passwd:

http://localhost:8000/admin/doc/templates//etc/passwd/

In (2) we see that the file is read and its contents are passed to the rendering method. We could not find a way to display the results but a more in depth look into this seems advisable.

Impact

An authenticated malicious admin can disclose the presence of arbitrary files.

Resources

• https://github.com/django/django/blob/e1e81aa1c4427411e3c68facdd761229ffea6f6f/django/contrib/admindocs/views.py#L336
• https://www.djangoproject.com/weblog/2021/jun/02/security-releases/

CVE

• CVE-2021-33203

Credit

This issue was discovered by Rasmus Lerchedahl Petersen and Rasmus Wriedt Larsen from the CodeQL Python team.

Contact

You can contact the GHSL team at [email protected], please include GHSL-2021-075 in any communication regarding this issue.