Skip to content

Commit 203d4ab

Browse files
felixxmcarltongibson
felixxm
authored and
carltongibson
committed
[3.1.x] Fixed CVE-2021-33571 -- Prevented leading zeros in IPv4 addresses.
validate_ipv4_address() was affected only on Python < 3.9.5, see [1]. URLValidator() uses a regular expressions and it was affected on all Python versions. [1] https://bugs.python.org/issue36384
1 parent 20c67a0 commit 203d4ab

6 files changed

Lines changed: 73 additions & 1 deletion

File tree

‎django/core/validators.py‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ class URLValidator(RegexValidator):
6464
ul = '\u00a1-\uffff' # Unicode letters range (must not be a raw string).
6565

6666
# IP patterns
67-
ipv4_re = r'(?:25[0-5]|2[0-4]\d|[0-1]?\d?\d)(?:\.(?:25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}'
67+
ipv4_re = r'(?:0|25[0-5]|2[0-4]\d|1\d?\d?|[1-9]\d?)(?:\.(?:0|25[0-5]|2[0-4]\d|1\d?\d?|[1-9]\d?)){3}'
6868
ipv6_re = r'\[[0-9a-f:.]+\]' # (simple regex, validated later)
6969

7070
# Host patterns
@@ -247,6 +247,18 @@ def validate_ipv4_address(value):
247247
ipaddress.IPv4Address(value)
248248
except ValueError:
249249
raise ValidationError(_('Enter a valid IPv4 address.'), code='invalid')
250+
else:
251+
# Leading zeros are forbidden to avoid ambiguity with the octal
252+
# notation. This restriction is included in Python 3.9.5+.
253+
# TODO: Remove when dropping support for PY39.
254+
if any(
255+
octet != '0' and octet[0] == '0'
256+
for octet in value.split('.')
257+
):
258+
raise ValidationError(
259+
_('Enter a valid IPv4 address.'),
260+
code='invalid',
261+
)
250262

251263

252264
def validate_ipv6_address(value):

‎docs/releases/2.2.24.txt‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,16 @@ the existence but also the file contents would have been exposed.
1717

1818
As a mitigation, path sanitation is now applied and only files within the
1919
template root directories can be loaded.
20+
21+
CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses
22+
===========================================================================================================================
23+
24+
:class:`~django.core.validators.URLValidator`,
25+
:func:`~django.core.validators.validate_ipv4_address`, and
26+
:func:`~django.core.validators.validate_ipv46_address` didn't prohibit leading
27+
zeros in octal literals. If you used such values you could suffer from
28+
indeterminate SSRF, RFI, and LFI attacks.
29+
30+
:func:`~django.core.validators.validate_ipv4_address` and
31+
:func:`~django.core.validators.validate_ipv46_address` validators were not
32+
affected on Python 3.9.5+.

‎docs/releases/3.1.12.txt‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,16 @@ the existence but also the file contents would have been exposed.
1717

1818
As a mitigation, path sanitation is now applied and only files within the
1919
template root directories can be loaded.
20+
21+
CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses
22+
===========================================================================================================================
23+
24+
:class:`~django.core.validators.URLValidator`,
25+
:func:`~django.core.validators.validate_ipv4_address`, and
26+
:func:`~django.core.validators.validate_ipv46_address` didn't prohibit leading
27+
zeros in octal literals. If you used such values you could suffer from
28+
indeterminate SSRF, RFI, and LFI attacks.
29+
30+
:func:`~django.core.validators.validate_ipv4_address` and
31+
:func:`~django.core.validators.validate_ipv46_address` validators were not
32+
affected on Python 3.9.5+.

‎tests/validators/invalid_urls.txt‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,14 @@ http://1.1.1.1.1
4646
http://123.123.123
4747
http://3628126748
4848
http://123
49+
http://000.000.000.000
50+
http://016.016.016.016
51+
http://192.168.000.001
52+
http://01.2.3.4
53+
http://01.2.3.4
54+
http://1.02.3.4
55+
http://1.2.03.4
56+
http://1.2.3.04
4957
http://.www.foo.bar/
5058
http://.www.foo.bar./
5159
http://[::1:2::3]:8080/

‎tests/validators/tests.py‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,16 @@
135135
(validate_ipv4_address, '1.1.1.1\n', ValidationError),
136136
(validate_ipv4_address, '٧.2٥.3٣.243', ValidationError),
137137

138+
# Leading zeros are forbidden to avoid ambiguity with the octal notation.
139+
(validate_ipv4_address, '000.000.000.000', ValidationError),
140+
(validate_ipv4_address, '016.016.016.016', ValidationError),
141+
(validate_ipv4_address, '192.168.000.001', ValidationError),
142+
(validate_ipv4_address, '01.2.3.4', ValidationError),
143+
(validate_ipv4_address, '01.2.3.4', ValidationError),
144+
(validate_ipv4_address, '1.02.3.4', ValidationError),
145+
(validate_ipv4_address, '1.2.03.4', ValidationError),
146+
(validate_ipv4_address, '1.2.3.04', ValidationError),
147+
138148
# validate_ipv6_address uses django.utils.ipv6, which
139149
# is tested in much greater detail in its own testcase
140150
(validate_ipv6_address, 'fe80::1', None),
@@ -160,6 +170,16 @@
160170
(validate_ipv46_address, '::zzz', ValidationError),
161171
(validate_ipv46_address, '12345::', ValidationError),
162172

173+
# Leading zeros are forbidden to avoid ambiguity with the octal notation.
174+
(validate_ipv46_address, '000.000.000.000', ValidationError),
175+
(validate_ipv46_address, '016.016.016.016', ValidationError),
176+
(validate_ipv46_address, '192.168.000.001', ValidationError),
177+
(validate_ipv46_address, '01.2.3.4', ValidationError),
178+
(validate_ipv46_address, '01.2.3.4', ValidationError),
179+
(validate_ipv46_address, '1.02.3.4', ValidationError),
180+
(validate_ipv46_address, '1.2.03.4', ValidationError),
181+
(validate_ipv46_address, '1.2.3.04', ValidationError),
182+
163183
(validate_comma_separated_integer_list, '1', None),
164184
(validate_comma_separated_integer_list, '12', None),
165185
(validate_comma_separated_integer_list, '1,2', None),

‎tests/validators/valid_urls.txt‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,12 @@ http://0.0.0.0/
6767
http://255.255.255.255
6868
http://224.0.0.0
6969
http://224.1.1.1
70+
http://111.112.113.114/
71+
http://88.88.88.88/
72+
http://11.12.13.14/
73+
http://10.20.30.40/
74+
http://1.2.3.4/
75+
http://127.0.01.09.home.lan
7076
http://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.example.com
7177
http://example.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.com
7278
http://example.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

0 commit comments

Comments
 (0)