CVE-2019-14233

Vulnerability

Overview

CVE-2019-14233 is a denial-of-service (DoS) vulnerability in Django's django.utils.html.strip_tags function. The root cause lies in the behavior of the underlying HTMLParser when evaluating certain inputs containing large sequences of nested incomplete HTML entities. This leads to extreme slowness, allowing an attacker to exhaust server resources [1][2].

Attack

Vector

An attacker can exploit this vulnerability by providing specially crafted input to any application that uses the strip_tags function or related template filters (e.g., striptags). No authentication is required if the input is user-controlled, and the attack can be performed remotely over HTTP. The crafted input triggers catastrophic backtracking or excessive processing in the HTML parser, resulting in a denial-of-service condition [3][4].

Impact

Successful exploitation allows an attacker to cause the Django application to consume excessive CPU time, potentially leading to a full denial-of-service for legitimate users. The vulnerability does not lead to data disclosure or privilege escalation, but it can disrupt application availability [1][4].

Mitigation

Django released patched versions 1.11.23, 2.1.11, and 2.2.4 on August 1, 2019, which address this issue by improving the handling of HTML entities within strip_tags. All users running affected versions are strongly advised to upgrade immediately. No workaround is available other than applying the patch [1][4].