Описание
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
django.contrib.admin.utils.display_for_field() renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.
Exploitation requires the unsafe value to already be stored in the database. URLField validation through a ModelForm or the admin rejects unsafe schemes, so this affects applications that persist URLField data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.
Django would like to thank Egor Saltykov for reporting this issue.
A flaw was found in Django. The django.contrib.admin.utils.display_for_field() function renders URLField values as clickable links in the administrative interface without proper validation. If an application persists URLField data containing an unsafe scheme without running model validation, a remote attacker could store a malicious URL. When a staff user clicks this link on changelist or read-only admin pages, it could lead to cross-site scripting (XSS), allowing the attacker to execute arbitrary scripts in the user's browser.
Отчет
This Moderate severity cross-site scripting (XSS) vulnerability in Django's administrative interface affects Red Hat products utilizing Django, such as Red Hat Ansible Automation Platform and Red Hat Satellite. The flaw occurs when URLField values are rendered as clickable links without proper validation, allowing a stored malicious URL to execute arbitrary scripts if clicked by a staff user. Exploitation is contingent on an unsafe URL already being present in the database, typically due to applications persisting URLField data without model validation.
Меры по смягчению последствий
To mitigate this issue, ensure that all applications persisting URLField data into the Django database perform proper model validation. This is especially critical for data imported via direct queryset writes, deserialization, or bulk import processes, which may bypass standard ModelForm or admin validation. Implementing robust input validation at the application level for all URLField inputs will prevent the storage of malicious URLs.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/controller-rhel8 | Out of support scope | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/eda-controller-rhel8 | Out of support scope | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/hub-rhel8 | Out of support scope | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/lightspeed-rhel8 | Out of support scope | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/ansible-dev-tools-rhel8 | Out of support scope | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/controller-rhel8 | Out of support scope | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/eda-controller-rhel8 | Out of support scope | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/gateway-rhel8 | Out of support scope | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/hub-rhel8 | Out of support scope | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/lightspeed-rhel8 | Out of support scope |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.4 Medium
CVSS3
Связанные уязвимости
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link. Exploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input. Django would like to thank Egor Saltykov for reporting this issue.
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link. Exploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input. Django would like to thank Egor Saltykov for reporting this issue.
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0 ...
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link. Exploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input. Django would like to thank Egor Saltykov for reporting this issue.
EPSS
5.4 Medium
CVSS3