Miggo Logo
Miggo Vulnerability Database
→
CVE-2017-20182

CVE-2017-20182: Cross-site Scripting in django-ajax-utilities

6.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2017-20182
GHSA ID
GHSA-p4g9-c9qr-wmg5
EPSS Score
0.18277%
CWE
CWE-79
Published
3/10/2023
Updated
10/20/2023
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
django-ajax-utilitiespip< 1.2.81.2.8

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the ajax function's URL handling in pagination.js. The original code only checked if the URL started with '/' and didn't have two slashes. Attackers could bypass this by using backslashes (e.g., '#page:/\google.com'), which modern browsers normalize to valid URLs. The patch explicitly adds a check for '/\' to block this vector. The function's direct manipulation of untrusted URL input without proper sanitization matches the XSS vulnerability pattern described in CWE-79.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility w*s *oun* in Mo*il* Vikin*s *j*n*o *J*X Utiliti*s *n* *l*ssi*i** *s pro*l*m*ti*. T*is issu* *****ts t** *un*tion P**in*tion o* t** *il* *j*n*o_*j*x/st*ti*/*j*x-utiliti*s/js/p**in*tion.js o* t** *ompon*nt ***ksl*s* **n*l*r. T** m*nipul

Reasoning

T** vuln*r**ility st*ms *rom t** *j*x *un*tion's URL **n*lin* in `p**in*tion.js`. T** ori*in*l *o** only ****k** i* t** URL st*rt** wit* '/' *n* *i*n't **v* two sl*s**s. *tt**k*rs *oul* *yp*ss t*is *y usin* ***ksl*s**s (*.*., '#p***:/\*oo*l*.*om'), w