CVE-2024-21520: 
Python vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in djangorestframework versions prior to 3.15.2. The vulnerability (CVE-2024-21520) exists in the break_long_headers template filter due to improper input sanitization before splitting and joining with tags. The issue was disclosed on June 13, 2024, and affects the Django REST framework package (Snyk).

The vulnerability occurs in the break_long_headers template filter used in the rest_framework/base.html template file by APIView. The issue stems from unsanitized user input being processed by the template filter before splitting and joining with tags. The vulnerability has been assigned a CVSS v4.0 base score of 5.3 (Medium) and CVSS v3.1 base score of 6.1 (Medium). The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (Snyk).

If exploited, this vulnerability could allow attackers to execute cross-site scripting attacks through the manipulation of header values. The impact primarily affects the integrity and confidentiality of the application with limited scope. The vulnerability could potentially be used to steal cookies, hijack user sessions, expose sensitive information, or deliver malware (Snyk).

The vulnerability requires network access and partial user interaction to exploit. A proof-of-concept exploit has been developed demonstrating the vulnerability through the manipulation of the Location header in API responses. The exploit probability is rated at 0.05% (19th percentile) according to the EPSS model (Snyk).

The vulnerability has been fixed in djangorestframework version 3.15.2. Users should upgrade to this version or later to address the security issue. The fix involves properly escaping the header input before processing in the break_long_headers template filter (GitHub Commit).