8000 [3.2.x] Fixed CVE-2021-33571 -- Prevented leading zeros in IPv4 addre… · django/django@9f75e2e · GitHub
[go: up one dir, main page]
Skip to content

Commit 9f75e2e

Browse files
felixxmcarltongibson
felixxm
authored and
carltongibson
committed
[3.2.x] Fixed CVE-2021-33571 -- Prevented leading zeros in IPv4 addresses.
validate_ipv4_address() was affected only on Python < 3.9.5, see [1]. URLValidator() uses a regular expressions and it was affected on all Python versions. [1] https://bugs.python.org/issue36384
1 parent dfaba12 commit 9f75e2e

File tree

7 files changed

+87
-1
lines changed

7 files changed

+87
-1
lines changed

‎django/core/validators.py‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ class URLValidator(RegexValidator):
6666
ul = '\u00a1-\uffff' # Unicode letters range (must not be a raw string).
6767

6868
# IP patterns
69-
ipv4_re = r'(?:25[0-5]|2[0-4]\d|[0-1]?\d?\d)(?:\.(?:25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}'
69+
ipv4_re = r'(?:0|25[0-5]|2[0-4]\d|1\d?\d?|[1-9]\d?)(?:\.(?:0|25[0-5]|2[0-4]\d|1\d?\d?|[1-9]\d?)){3}'
7070
ipv6_re = r'\[[0-9a-f:.]+\]' # (simple regex, validated later)
7171

7272
# Host patterns
@@ -276,6 +276,19 @@ def validate_ipv4_address(value):
276276
ipaddress.IPv4Address(value)
277277
except ValueError:
278278
raise ValidationError(_('Enter a valid IPv4 address.'), code='invalid', params={'value': value})
279+
else:
280+
# Leading zeros are forbidden to avoid ambiguity with the octal
281+
# notation. This restriction is included in Python 3.9.5+.
282+
# TODO: Remove when dropping support for PY39.
283+
if any(
284+
octet != '0' and octet[0] == '0'
285+
for octet in value.split('.')
286+
):
287+
raise ValidationError(
288+
_('Enter a valid IPv4 address.'),
289+
code='invalid',
290+
params={'value': value},
291+
)
279292

280293

281294
def validate_ipv6_address(value):

‎docs/releases/2.2.24.txt‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,16 @@ the existence but also the file contents would have been exposed.
1717

1818
As a mitigation, path sanitation is now applied and only files within the
1919
template root directories can be loaded.
20+
21+
CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses
22+
===========================================================================================================================
23+
24+
:class:`~django.core.validators.URLValidator`,
25+
:func:`~django.core.validators.validate_ipv4_address`, and
26+
:func:`~django.core.validators.validate_ipv46_address` didn't prohibit leading
27+
zeros in octal literals. If you used such values you could suffer from
28+
indeterminate SSRF, RFI, and LFI attacks.
29+
30+
:func:`~django.core.validators.validate_ipv4_address` and
31+
:func:`~django.core.validators.validate_ipv46_address` validators were not
32+
affected on Python 3.9.5+.

‎docs/releases/3.1.12.txt‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,16 @@ the existence but also the file contents would have been exposed.
1717

1818
As a mitigation, path sanitation is now applied and only files within the
1919
template root directories can be loaded.
20+
21+
CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses
22+
===========================================================================================================================
23+
24+
:class:`~django.core.validators.URLValidator`,
25+
:func:`~django.core.validators.validate_ipv4_address`, and
26+
:func:`~django.core.validators.validate_ipv46_address` didn't prohibit leading
27+
zeros in octal literals. If you used such values you could suffer from
28+
indeterminate SSRF, RFI, and LFI attacks.
29+
30+
:func:`~django.core.validators.validate_ipv4_address` and
31+
:func:`~django.core.validators.validate_ipv46_address` validators were not
32+
affected on Python 3.9.5+.

‎docs/releases/3.2.4.txt‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,19 @@ the existence but also the file contents would have been exposed.
1818
As a mitigation, path sanitation is now applied and only files within the
1919
template root directories can be loaded.
2020

21+
CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses
22+
===========================================================================================================================
23+
24+
:class:`~django.core.validators.URLValidator`,
25+
:func:`~django.core.validators.validate_ipv4_address`, and
26+
:func:`~django.core.validators.validate_ipv46_address` didn't prohibit leading
27+
zeros in octal literals. If you used such values you could suffer from
28+
indeterminate SSRF, RFI, and LFI attacks.
29+
30+
:func:`~django.core.validators.validate_ipv4_address` and
31+
:func:`~django.core.validators.validate_ipv46_address` validators were not
32+
affected on Python 3.9.5+.
33+
2134
Bugfixes
2235
========
2336

‎tests/validators/invalid_urls.txt‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,14 @@ http://1.1.1.1.1
4646
http://123.123.123
4747
http://3628126748
4848
http://123
49+
http://000.000.000.000
50+
http://016.016.016.016
51+
http://192.168.000.001
52+
http://01.2.3.4
53+
http://01.2.3.4
54+
http://1.02.3.4
55+
http://1.2.03.4
56+
http://1.2.3.04
4957
http://.www.foo.bar/
5058
http://.www.foo.bar./
5159
http://[::1:2::3]:8080/

‎tests/validators/tests.py‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,16 @@
136136
(validate_ipv4_address, '1.1.1.1\n', ValidationError),
137137
(validate_ipv4_address, '٧.2٥.3٣.243', ValidationError),
138138

139+
# Leading zeros are forbidden to avoid ambiguity with the octal notation.
140+
(validate_ipv4_address, '000.000.000.000', ValidationError),
141+
(validate_ipv4_address, '016.016.016.016', ValidationError),
142+
(validate_ipv4_address, '192.168.000.001', ValidationError),
143+
(validate_ipv4_address, '01.2.3.4', ValidationError),
144+
(validate_ipv4_address, '01.2.3.4', ValidationError),
145+
(validate_ipv4_address, '1.02.3.4', ValidationError),
146+
(validate_ipv4_address, '1.2.03.4', ValidationError),
147+
(validate_ipv4_address, '1.2.3.04', ValidationError),
148+
139149
# validate_ipv6_address uses django.utils.ipv6, which
140150
# is tested in much greater detail in its own testcase
141151
(validate_ipv6_address, 'fe80::1', None),
@@ -161,6 +171,16 @@
161171
(validate_ipv46_address, '::zzz', ValidationError),
162172
(validate_ipv46_address, '12345::', ValidationError),
163173

174+
# Leading zeros are forbidden to avoid ambiguity with the octal notation.
175+
(validate_ipv46_address, '000.000.000.000', ValidationError),
176+
(validate_ipv46_address, '016.016.016.016', ValidationError),
177+
(validate_ipv46_address, '192.168.000.001', ValidationError),
178+
(validate_ipv46_address, '01.2.3.4', ValidationError),
179+
(validate_ipv46_address, '01.2.3.4', ValidationError),
180+
(validate_ipv46_address, '1.02.3.4', ValidationError),
181+
(validate_ipv46_address, '1.2.03.4', ValidationError),
182+
(validate_ipv46_address, '1.2.3.04', ValidationError),
183+
164184
(validate_comma_separated_integer_list, '1', None),
165185
(validate_comma_separated_integer_list, '12', None),
166186
(validate_comma_separated_integer_list, '1,2', None),

‎tests/validators/valid_urls.txt‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,12 @@ http://0.0.0.0/
7171
http://255.255.255.255
7272
http://224.0.0.0
7373
http://224.1.1.1
74+
http://111.112.113.114/
75+
http://88.88.88.88/
76+
http://11.12.13.14/
77+
http://10.20.30.40/
78+
http://1.2.3.4/
79+
http://127.0.01.09.home.lan
7480
http://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.example.com
7581
http://example.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.com
7682
http://example.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

0 commit comments

Comments
 (0)
0