.. / CVE-2017-12794

Exploit for Django Debug Page - Cross-Site Scripting (CVE-2017-12794)

Description:

Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5 has HTML autoescaping disabled in a portion of the template for the technical 500 debug page. We detected that right circumstances (DEBUG=True) are present to allow a cross-site scripting attack.

Nuclei Template

View the template here CVE-2017-12794.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2017/CVE-2017-12794.yaml
Copy

References:

https://twitter.com/sec715/status/1406779605055270914
https://nvd.nist.gov/vuln/detail/CVE-2017-12794
http://www.securitytracker.com/id/1039264
http://web.archive.org/web/20211207172022/https://securitytracker.com/id/1039264
https://www.djangoproject.com/weblog/2017/sep/05/security-releases/