Python Library Django 4.2.x < 4.2.28 / 5.2.x < 5.2.11 / 6.0.x < 6.0.2 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(298044);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/10");

  script_cve_id(
    "CVE-2025-13473",
    "CVE-2025-14550",
    "CVE-2026-1207",
    "CVE-2026-1285",
    "CVE-2026-1287",
    "CVE-2026-1312"
  );
  script_xref(name:"IAVA", value:"2026-A-0105-S");

  script_name(english:"Python Library Django 4.2.x < 4.2.28 / 5.2.x < 5.2.11 / 6.0.x < 6.0.2 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"A Python library installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The detected version of the Django Python package, Django, is 4.2.x prior to 4.2.28, 5.2.x prior to 5.2.11, or 6.0.x
prior to 6.0.2. It is, therefore, affected by multiple vulnerabilities as referenced by security release advisory:

  - The django.contrib.auth.handlers.modwsgi.check_password() function for authentication via mod_wsgi allows
    remote attackers to enumerate users via a timing attack. (CVE-2025-13473)

  - ASGIRequest allows a remote attacker to cause a potential denial-of-service via a crafted request with
    multiple duplicate headers. (CVE-2025-14550)

  - Raster lookups on RasterField (only implemented on PostGIS) allows remote attackers to inject SQL via the
    band index parameter. (CVE-2026-1207)

  - django.utils.text.Truncator.chars() and Truncator.words() methods (with html=True) and the
    truncatechars_html and truncatewords_html template filters allow a remote attacker to cause a potential
    denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. (CVE-2026-1285)

  - FilteredRelation is subject to SQL injection in column aliases via control characters, using a suitably
    crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet methods annotate(),
    aggregate(), extra(), values(), values_list(), and alias(). (CVE-2026-1287)

  - QuerySet.order_by() is subject to SQL injection in column aliases containing periods when the same alias
    is, using a suitably crafted dictionary, with dictionary expansion, used in FilteredRelation.
    (CVE-2026-1312)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.djangoproject.com/weblog/2026/feb/03/security-releases/");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Django version 4.2.28, 5.2.11, 6.0.2 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-1287");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-1312");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/02/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/02/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:djangoproject:django");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_packages_installed_nix.nbin", "python_packages_win_installed.nbin");
  script_require_ports("Host/nix/Python/Packages/Enumerated", "Host/win/Python/Packages/Enumerated");

  exit(0);
}

include('python.inc');

var pkg = 'Django';

var libs = python::get_package_info(pkg_name:pkg, cpe:"cpe:/a:djangoproject:django");

if (empty_or_null(libs))
  audit(AUDIT_NOT_INST, pkg);

vcf::check_all_backporting(app_info:libs);

var constraints = [
  { 'min_version' : '4.2' , 'fixed_version' : '4.2.28' },
  { 'min_version' : '5.2' , 'fixed_version' : '5.2.11' },
  { 'min_version' : '6.0' , 'fixed_version' : '6.0.2' }
];

vcf::check_version_and_report(
  app_info:libs,
  constraints:constraints,
  severity:SECURITY_HOLE
);