Python Library Django 4.2.x < 4.2.27 / 5.1.x < 5.1.15 / 5.2.x < 5.2.9 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(277467);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/03");

  script_cve_id("CVE-2025-13372", "CVE-2025-64460");
  script_xref(name:"IAVA", value:"2025-A-0887-S");

  script_name(english:"Python Library Django 4.2.x < 4.2.27 / 5.1.x < 5.1.15 / 5.2.x < 5.2.9 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"A Python library installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The detected version of the Django Python package, Django, is 4.2.x prior to 4.2.27, 5.1.x prior to 5.1.15, or 5.2.x
prior to 5.2.9. It is, therefore, affected by multiple vulnearabilities as referenced by security release advisory:

  - An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` 
    is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary 
    expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL. 
    Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be 
    affected. Django would like to thank Stackered for reporting this issue. (CVE-2025-13372)

  - An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic 
    complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a 
    potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input 
    processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) 
    were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this 
    issue. (CVE-2025-64460)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.djangoproject.com/weblog/2025/dec/02/security-releases/");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Django version 4.2.27, 5.1.15, 5.2.9 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-64460");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-13372");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:djangoproject:django");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_packages_installed_nix.nbin", "python_packages_win_installed.nbin");
  script_require_ports("Host/nix/Python/Packages/Enumerated", "Host/win/Python/Packages/Enumerated");

  exit(0);
}

include('python.inc');

var pkg = 'Django';

var libs = python::get_package_info(pkg_name:pkg, cpe:"cpe:/a:djangoproject:django");

if (empty_or_null(libs))
  audit(AUDIT_NOT_INST, pkg);

vcf::check_all_backporting(app_info:libs);

var constraints = [
  { 'min_version' : '4.2' , 'fixed_version' : '4.2.27' },
  { 'min_version' : '5.1' , 'fixed_version' : '5.1.15' },
  { 'min_version' : '5.2' , 'fixed_version' : '5.2.9' }
];

vcf::check_version_and_report(
  app_info:libs,
  constraints:constraints,
  severity:SECURITY_HOLE
);