Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a csrfmiddlewaretoken (aka csrf_token) cookie.

It was discovered that Django did not properly sanitize the cookie value when applying CSRF protections resulting in a cross-site scripting (XSS) vulnerability. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

' Today the Django team has released Django 1.2.3, which remedies several issues with the recent 1.2.2 package.

This package corrects the following problems :

  - The patch applied for the security issue covered in     Django 1.2.2 caused issues with non-ASCII responses     using CSRF tokens. This has been remedied.

    - The patch also caused issues with some forms, most       notably the user-editing forms in the Django       administrative interface. This has been remedied.

    - The packaging manifest did not contain the full list       of required files. This has been remedied. '

See: http://www.djangoproject.com/weblog/2010/sep/10/123/ See http://www.djangoproject.com/weblog/2010/sep/08/security-release/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Django project reports :

The provided template tag for inserting the CSRF token into forms -- {% csrf_token %} -- explicitly trusts the cookie value, and displays it as-is. Thus, an attacker who is able to tamper with the value of the CSRF cookie can cause arbitrary content to be inserted, unescaped, into the outgoing HTML of the form, enabling cross-site scripting (XSS) attacks.

See http://www.djangoproject.com/weblog/2010/sep/08/security-release/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
49995	Ubuntu 10.10 : python-django vulnerability (USN-1004-1)	Nessus	Ubuntu Local Security Checks	medium
49663	Fedora 14 : Django-1.2.3-1.fc14 (2010-14745)	Nessus	Fedora Local Security Checks	medium
49273	FreeBSD : django -- XSS vulnerability (3ff95dd3-c291-11df-b0dc-00215c6a37bb)	Nessus	FreeBSD Local Security Checks	medium
49199	Fedora 12 : Django-1.2.2-1.fc12 (2010-14430)	Nessus	Fedora Local Security Checks	medium
49198	Fedora 13 : Django-1.2.2-1.fc13 (2010-14398)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2010-3082

medium

Tenable Plugins

medium

medium

medium

medium

medium