Bug 1004969 (CVE-2013-4315) - CVE-2013-4315 python-django: directory traversal with "ssi" template tag
Summary: CVE-2013-4315 python-django: directory traversal with "ssi" template tag
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2013-4315
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=low,public=20130910,reported=2...
Depends On: 1007018 1007019 1007020 1007021 1007022 1007023 1007024
Blocks: 1004971
TreeView+ depends on / blocked
 
Reported: 2013-09-05 22:08 UTC by Vincent Danen
Modified: 2019-06-08 19:42 UTC (History)
17 users (show)

Fixed In Version: Django 1.4.7, Django 1.5.3
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-01-20 18:51:59 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:1521 normal SHIPPED_LIVE Moderate: python-django security update 2013-11-14 22:29:40 UTC

Description Vincent Danen 2013-09-05 22:08:29 UTC
Django upstream reported the following vulnerability in Django:

Django's template language includes two methods of including and
rendering one template inside another:

1. The ``{% include %}`` tag takes a template name, and uses Django's
template loading mechanism (which is restricted to the directories
specified in the ``TEMPLATE_DIRS`` setting, as with any other
normal template load in Django).

2. The ``{% ssi %}`` tag, which takes a file path and includes that
file's contents (optionally parsing and rendering it as a
template).

Since the ``ssi`` tag is not restricted to ``TEMPLATE_DIRS``, it
represents a security risk; the setting ``ALLOWED_INCLUDE_ROOTS`` thus
is required, and specifies filesystem locations from which ``ssi`` may
read files.

A report has been submitted to and confirmed by the Django core team,
showing that the handling of the ``ALLOWED_INCLUDE_ROOTS`` setting is
vulnerable to a directory-traversal attack, by specifying a file path
which begins as the absolute path of a directory in
``ALLOWED_INCLUDE_ROOTS``, and then uses relative paths to break
free. So, for example, if ``/var/include`` is in
``ALLOWED_INCLUDE_ROOTS``, the following would be accepted:

{% ssi '/var/includes/../../etc/passwd' %}

Which would include the contents of ``/etc/passwd`` in the template's
output.

Note that performing this attack does require some specific
circumstances:

* The site to be attacked must have one or more templates making use
of the ``ssi`` tag, and must allow some form of unsanitized user
input to be used as an argument to the ``ssi`` tag, or

* The attacker must be in a position to alter templates on the site.

To remedy this, the ``ssi`` tag will now use Python's
``os.path.abspath`` to determine the absolute path of the file, and
whether it is actually located within a directory permitted by
``ALLOWED_INCLUDE_ROOTS``.


Acknowledgements:

Red Hat would like to thank James Bennett of Django for reporting this issue.

Comment 1 Vincent Danen 2013-09-11 18:17:33 UTC
External Reference:

https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/

Comment 4 Vincent Danen 2013-09-11 18:22:46 UTC
Created Django14 tracking bugs for this issue:

Affects: epel-6 [bug 1007020]

Comment 5 Vincent Danen 2013-09-11 18:22:54 UTC
Created python-django14 tracking bugs for this issue:

Affects: fedora-19 [bug 1007019]

Comment 6 Vincent Danen 2013-09-11 18:23:03 UTC
Created python-django tracking bugs for this issue:

Affects: fedora-all [bug 1007018]

Comment 7 Fedora Update System 2013-09-24 22:56:34 UTC
python-django-1.5.4-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2013-09-24 23:00:16 UTC
python-django14-1.4.8-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2013-09-24 23:05:04 UTC
python-django14-1.4.8-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2013-10-01 17:35:42 UTC
Django14-1.4.8-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 errata-xmlrpc 2013-11-14 17:34:56 UTC
This issue has been addressed in following products:

  OpenStack 3 for RHEL 6

Via RHSA-2013:1521 https://rhn.redhat.com/errata/RHSA-2013-1521.html


Note You need to log in before you can comment on or make changes to this bug.