CVE-2020-15225highCWE-681

CVE-2020-15225: high-severity vulnerability in carltongibson django-filter

Denial of Service vulnerability in django-filter

Published · Updated

Follow this CVE+ Monitor django-filter+ Monitor django-filter

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.8%
In short

django-filter's NumberFilter was vulnerable to denial of service attacks when users submitted numbers in exponential format (like 1e999999) with huge exponents, causing the server to hang or crash while processing. This was fixed by adding a limit validator in version 2.4.0.

Technical detail

Automatically generated NumberFilter instances in django-filter < 2.4.0 failed to validate exponential notation input before integer conversion, allowing attackers to submit extremely large exponents (e.g., 1e50+) that consumed excessive CPU during parsing, resulting in DoS. The fix introduces MaxValueValidator with a default limit_value of 1e50 and a new get_max_validator() method for customization.

Summary generated and translated by AI from the official description.
django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. Users may manually apply an equivalent validator if they are not able to upgrade.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
carltongibson · django-filter