Bug 1200922 (CVE-2015-2241) - CVE-2015-2241 Django: XSS attack via properties in ModelAdmin.readonly_fields
Summary: CVE-2015-2241 Django: XSS attack via properties in ModelAdmin.readonly_fields
Alias: CVE-2015-2241
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On:
TreeView+ depends on / blocked
Reported: 2015-03-11 16:18 UTC by Martin Prpič
Modified: 2023-05-12 07:39 UTC (History)
23 users (show)

Fixed In Version: Django 1.7.6, Django 1.8b2
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2015-03-11 16:20:32 UTC

Attachments (Terms of Use)

Description Martin Prpič 2015-03-11 16:18:10 UTC
The following flaw was found in Django 1.7 and 1.8:

The ModelAdmin.readonly_fields attribute in the Django admin allows displaying model fields and model attributes. While the former were correctly escaped, the latter were not. Thus untrusted content could be injected into the admin, presenting an exploitation vector for XSS attacks.

In this vulnerability, every model attribute used in readonly_fields that is not an actual model field (e.g. a @property) will fail to be escaped even if that attribute is not marked as safe. In this release, autoescaping is now correctly applied.

Upstream Issue:


Upstream patches:

1.8 -- https://github.com/django/django/commit/d16e4e1d6f95e6f46bff53cc4fd0ab398b8e5059
1.7 -- https://github.com/django/django/commit/2654e1b93923bac55f12b4e66c5e39b16695ace5


Red Hat would like to thank the upstream Django project for reporting this issue.

Comment 1 Martin Prpič 2015-03-11 16:19:56 UTC
External References:


Comment 2 Martin Prpič 2015-03-11 16:20:32 UTC

Not vulnerable. The 1.7 and 1.8 versions of Django are not shipped in any Red Hat product as of March 2015.

Comment 3 Matthias Runge 2015-03-11 19:21:32 UTC
There was a short period of time, where vulnerable Django versions were shipped in Fedora 22 alpha and Rawhide. 

Both are fixed now with python-django-1.8-0.6.b2.fc22

Unfortunately, that is not pushed to f22 yet.

Note You need to log in before you can comment on or make changes to this bug.