CVE-2012-3442 in django
Summary
by MITRE
The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/22/2026
The vulnerability identified as CVE-2012-3442 affects the Django web framework's HTTP response redirect functionality, specifically impacting the HttpResponseRedirect and HttpResponsePermanentRedirect classes. This issue exists in Django versions prior to 1.3.2 and 1.4.x versions before 1.4.1, creating a significant security gap that could be exploited by remote attackers to execute cross-site scripting attacks through maliciously crafted redirect URLs. The flaw stems from inadequate validation of the URL scheme in redirect targets, allowing attackers to manipulate the redirect behavior in ways that bypass normal security controls.
The technical implementation of this vulnerability lies in how Django handles URL validation for redirect operations. When developers use HttpResponseRedirect or HttpResponsePermanentRedirect classes to redirect users to external URLs, the framework fails to properly validate whether the target URL scheme is safe. This validation gap becomes particularly dangerous when attackers can craft URLs using the data: scheme, which allows embedding arbitrary content directly within the URL. The data: URL scheme can contain HTML content that gets executed in the victim's browser when the redirect occurs, creating a pathway for XSS attacks that can steal session cookies, deface websites, or perform other malicious actions on behalf of the user.
The operational impact of this vulnerability extends beyond simple XSS exploitation, as it represents a fundamental flaw in Django's security model for handling external redirects. Attackers can leverage this vulnerability by crafting malicious redirect URLs that contain embedded JavaScript or HTML content within data: URLs, bypassing traditional input validation mechanisms. This creates a persistent threat vector that can be exploited across different applications built on Django, affecting any system that relies on these redirect classes for user navigation or authentication flows. The vulnerability particularly impacts applications that dynamically generate redirect URLs based on user input or external parameters without proper sanitization.
Organizations using affected Django versions should immediately implement mitigation strategies focusing on input validation and URL sanitization. The primary recommended fix involves upgrading to Django versions 1.3.2 or 1.4.1, which include proper scheme validation for redirect targets. Additionally, developers should implement custom validation logic that explicitly checks URL schemes before allowing redirects, particularly rejecting data: and javascript: schemes in redirect contexts. Security controls should include implementing Content Security Policy headers to limit the execution of inline scripts and data URLs, while also establishing proper input sanitization processes that validate all redirect targets against a whitelist of approved schemes. This vulnerability aligns with CWE-79, Cross-site Scripting, and maps to ATT&CK techniques involving web application attacks and client-side exploitation, emphasizing the need for comprehensive security measures in web application frameworks.
The broader implications of this vulnerability highlight the critical importance of proper input validation in web frameworks, particularly when handling user-controllable data in security-sensitive contexts. The flaw demonstrates how seemingly innocuous functionality can become a gateway for sophisticated attacks when proper validation mechanisms are absent. Organizations should conduct thorough security assessments of their Django applications to identify all instances where redirect functionality is used, implementing automated testing procedures that validate URL schemes and content to prevent similar vulnerabilities from being exploited in the future.