Red Hat Bugzilla – Bug 1200922
CVE-2015-2241 Django: XSS attack via properties in ModelAdmin.readonly_fields
Last modified: 2016-04-26 15:07:52 EDT
The following flaw was found in Django 1.7 and 1.8: The ModelAdmin.readonly_fields attribute in the Django admin allows displaying model fields and model attributes. While the former were correctly escaped, the latter were not. Thus untrusted content could be injected into the admin, presenting an exploitation vector for XSS attacks. In this vulnerability, every model attribute used in readonly_fields that is not an actual model field (e.g. a @property) will fail to be escaped even if that attribute is not marked as safe. In this release, autoescaping is now correctly applied. Upstream Issue: https://code.djangoproject.com/ticket/24461 Upstream patches: 1.8 -- https://github.com/django/django/commit/d16e4e1d6f95e6f46bff53cc4fd0ab398b8e5059 1.7 -- https://github.com/django/django/commit/2654e1b93923bac55f12b4e66c5e39b16695ace5 Acknowledgements: Red Hat would like to thank the upstream Django project for reporting this issue.
External References: https://www.djangoproject.com/weblog/2015/mar/09/security-releases/
Statement: Not vulnerable. The 1.7 and 1.8 versions of Django are not shipped in any Red Hat product as of March 2015.
There was a short period of time, where vulnerable Django versions were shipped in Fedora 22 alpha and Rawhide. Both are fixed now with python-django-1.8-0.6.b2.fc22 Unfortunately, that is not pushed to f22 yet.