Django Log Injection Vulnerability via Unescaped Request Path

A log injection vulnerability has been identified in Django versions 5.2 prior to 5.2.2, 5.1 prior to 5.1.10, and 4.2 prior to 4.2.22. The issue arises because internal HTTP response logging does not properly escape the request path, allowing remote attackers to manipulate log output with crafted URLs. This could lead to log injection or forgery, particularly when logs are viewed in terminals or processed by external systems.

Impact

Exploitation of this vulnerability could result in log injection or forgery, allowing attackers to manipulate how log entries appear or are structured, with potential consequences for any systems that process these logs or for users viewing them in a terminal.

Remediation

Users can upgrade to Django versions 5.2.2, 5.1.10, or 4.2.22 to address this vulnerability.