Path Traversal in django-s3file

django-s3file (pip)

It was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files. The issue was discovered by the maintainer. There were no reports of the vulnerability being known to or exploited by a third party, before the release of the patch.

Fix it

pip install --upgrade "django-s3file>=5.5.1"

First seen: 6 Jun 2022
Last update: 6 Jun 2022, 21:24 UTC
Fixed in: django-s3file 5.5.1
Identifiers: CVE-2022-24840
Source: GitHub advisory
On the menu as: PyPI packages
Python

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Path Traversal in django-s3file
Severity: critical. Patch status: patched.
Affected: django-s3file (pip)
Fixed in: django-s3file 5.5.1
Ids: CVE-2022-24840

It was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files. The issue was discovered by the maintainer. There were no reports of the vulnerability being known to or exploited by a third party, before the release of the patch.

## Steps
1. Search the repo, its CI and infra config for django-s3file (pip). If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2022-24840") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/advisories/GHSA-4w8f-hjm9-xwgf https://github.com/codingjoe/django-s3file/commit/68ccd2c621a40eb66fdd6af2be9d5fcc9c373318 https://github.com/codingjoe/django-s3file/releases/tag/5.5.1 https://github.com/codingjoe/django-s3file/security/advisories/GHSA-4w8f-hjm9-xwgf https://nvd.nist.gov/vuln/detail/CVE-2022-24840
https://pwned.coffee/i/path-traversal-in-django-s3file-cve-2022-24840

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee