PT-2022-16914 · Unknown · Django-S3File

Codingjoe · Published 2022-06-06 · Updated 2022-06-17 · CVE-2022-24840

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions django-s3file versions prior to 5.5.1

Description The issue allows an attacker to traverse the entire AWS S3 bucket and in most cases access or delete files. If the AWS LOCATION setting was set, traversal was limited to that location only. The problem was discovered by the maintainer, and there were no reports of it being known to or exploited by a third party before the release of the patch. An attacker may use a request with malicious form data to perform destructive operations.

Recommendations For versions prior to 5.5.1, update to version 5.5.1 or above to fix the issue. There is no feasible workaround, and all users are urged to immediately update to a patched version. As a temporary measure, consider restricting access to sensitive files and locations in the AWS S3 bucket until the update is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-96

Related Identifiers

CVE-2022-24840

GHSA-4W8F-HJM9-XWGF

PYSEC-2022-208

Affected Products

Django-S3File

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24840.json · Exploit
• 🔥 https://github.com/codingjoe/django-s3file/security/advisories/GHSA-4w8f-hjm9-xwgf · Exploit
• https://github.com/codingjoe/django-s3file/commit/68ccd2c621a40eb66fdd6af2be9d5fcc9c373318 · Patch
• https://osv.dev/vulnerability/PYSEC-2022-208 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24840 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4w8f-hjm9-xwgf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24840 · Security Note
• https://github.com/pypa/advisory-database/tree/main/vulns/django-s3file/PYSEC-2022-208.yaml · Note
• https://github.com/codingjoe/django-s3file · Note
• https://github.com/codingjoe/django-s3file/releases/tag/5.5.1 · Note
• https://t.me/cibsecurity/44073 · Telegram Post