Bug 1200922 (CVE-2015-2241)

Summary: CVE-2015-2241 Django: XSS attack via properties in ModelAdmin.readonly_fields
Product: [Other] Security Response Reporter: Martin Prpič <mprpic>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abaron, aortega, apevec, ayoung, bkabrda, bkearney, cbillett, chrisw, dallan, gkotton, jdornak, katello-bugs, kseifried, lhh, lpeer, markmc, mhroncok, michel, mrunge, rbryant, sclewis, tomckay, yeylon
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Django 1.7.6, Django 1.8b2 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-03-11 16:20:32 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Martin Prpič 2015-03-11 16:18:10 UTC 
The following flaw was found in Django 1.7 and 1.8:

The ModelAdmin.readonly_fields attribute in the Django admin allows displaying model fields and model attributes. While the former were correctly escaped, the latter were not. Thus untrusted content could be injected into the admin, presenting an exploitation vector for XSS attacks.

In this vulnerability, every model attribute used in readonly_fields that is not an actual model field (e.g. a @property) will fail to be escaped even if that attribute is not marked as safe. In this release, autoescaping is now correctly applied.

Upstream Issue:

https://code.djangoproject.com/ticket/24461

Upstream patches:

1.8 -- https://github.com/django/django/commit/d16e4e1d6f95e6f46bff53cc4fd0ab398b8e5059
1.7 -- https://github.com/django/django/commit/2654e1b93923bac55f12b4e66c5e39b16695ace5

Acknowledgements:

Red Hat would like to thank the upstream Django project for reporting this issue.
Comment 1 Martin Prpič 2015-03-11 16:19:56 UTC 
External References:

https://www.djangoproject.com/weblog/2015/mar/09/security-releases/
Comment 2 Martin Prpič 2015-03-11 16:20:32 UTC 
Statement:

Not vulnerable. The 1.7 and 1.8 versions of Django are not shipped in any Red Hat product as of March 2015.
Comment 3 Matthias Runge 2015-03-11 19:21:32 UTC 
There was a short period of time, where vulnerable Django versions were shipped in Fedora 22 alpha and Rawhide. 

Both are fixed now with python-django-1.8-0.6.b2.fc22

Unfortunately, that is not pushed to f22 yet.