Miggo Logo

CVE-2021-44420: Potential bypass of an upstream access control based on URL paths in Django

7.3

CVSS Score
3.1

Basic Information

EPSS Score
0.28959%
Published
12/9/2021
Updated
11/18/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
Djangopip>= 2.2a1, < 2.2.252.2.25
Djangopip>= 3.0a1, < 3.1.143.1.14
Djangopip>= 3.2a1, < 3.2.103.2.10

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from how URL patterns were matched. The commit shows RegexPattern.match() originally used regex.search(), which allows partial matches. For endpoints, it should use fullmatch() with strict anchoring (\Z) to prevent trailing characters. The _route_to_regex function's '$' usage instead of \Z created regex patterns vulnerable to newline bypasses. These two functions directly implement the flawed URL matching logic described in CVE-2021-44420.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

In *j*n*o *.* ***or* *.*.**, *.* ***or* *.*.**, *n* *.* ***or* *.*.**, *TTP r*qu*sts *or URLs wit* tr*ilin* n*wlin*s *oul* *yp*ss upstr**m ****ss *ontrol **s** on URL p*t*s. T*is issu* **s low s*v*rity, ***or*in* to t** *j*n*o s**urity poli*y.

Reasoning

T** vuln*r**ility st*ms *rom *ow URL p*tt*rns w*r* m*t****. T** *ommit s*ows R***xP*tt*rn.m*t**() ori*in*lly us** r***x.s**r**(), w*i** *llows p*rti*l m*t***s. *or *n*points, it s*oul* us* *ullm*t**() wit* stri*t *n**orin* (\Z) to pr*v*nt tr*ilin* **