Server-Side Request Forgery (SSRF) in Django - CVE-2021-33571

Vulnerability identifier: #VU53742

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]

CVE-ID: CVE-2021-33571

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input in the "URLValidator", "validate_ipv4_address()" and "validate_ipv46_address()" . A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Django
Arch Linux
Gentoo Linux
Ubuntu
Fedora
python3-django (Ubuntu package)
python-django (Ubuntu package)
python-django20 (Red Hat package)
python-django
dev-python/django
Red Hat OpenStack

Install updates from vendor's website.

Django - addressed in versions 2.2.24, 3.1.12, 3.2.4
python3-django (Ubuntu package) - addressed in versions 1:1.11.11-1ubuntu1.14, 2:2.2.12-1ubuntu0.7, 2:2.2.16-1ubuntu0.5, 2:2.2.20-1ubuntu0.2
python-django (Ubuntu package) - update to 1:1.11.11-1ubuntu1.14
python-django20 (Red Hat package) - update to 2.0.13-16.el8ost.1
python-django - addressed in versions 3.2.12-1.fc35, 4.0.2-1.fc36
dev-python/django - update to 5.2.1
Red Hat OpenStack - addressed in versions 16.1, 16.2

• https://www.djangoproject.com/weblog/2021/jun/02/security-releases/

• Multiple vulnerabilities in Django
• Arch Linux update for python-django
• Ubuntu update for python-django
• Multiple vulnerabilities in Red Hat OpenStack 16.2 packages
• Multiple vulnerabilities in Red Hat OpenStack 16.1 packages
• Fedora 36 update for python-django
• Fedora 35 update for python-django
• Gentoo update for Django