CVE-2024-28865: Django-wiki DoS Vulnerability

CVE-2024-28865 Overview

CVE-2024-28865 is a regular expression denial of service (ReDoS) vulnerability in django-wiki, a wiki system for the Django web framework. Versions prior to 0.10.1 process article content with unsafe regular expressions that exhibit catastrophic backtracking. An attacker can submit maliciously crafted article content that forces the server into an extended regex evaluation loop, consuming CPU resources and degrading service availability. The flaw is categorized under [CWE-1333: Inefficient Regular Expression Complexity]. Version 0.10.1, released on 2024-03-16, contains the fix.

Critical Impact
Unauthenticated attackers can trigger sustained CPU exhaustion on django-wiki servers through crafted article content, resulting in service degradation or denial of service.

Affected Products

django-wiki versions prior to 0.10.1
Django applications integrating django-wiki for collaborative documentation
Deployments that permit anonymous users to create or edit articles

Discovery Timeline

2024-03-16 - django-wiki 0.10.1 released with the security fix (credit: Santos Gallegos, Benjamin Balder Bach)
2024-03-18 - CVE-2024-28865 published to NVD
2026-01-13 - Last updated in NVD database

Technical Details for CVE-2024-28865

Vulnerability Analysis

The vulnerability resides in regular expressions used by django-wiki to parse Markdown article content. Specific patterns in the wiki/core/markdown/mdx/codehilite.py module and related Markdown extensions trigger catastrophic backtracking when fed crafted input. Each malicious request occupies a worker thread for an extended period, blocking it from serving legitimate traffic. Because django-wiki renders article content on save and on view, the attacker controls when the expensive regex evaluation occurs and can amplify the impact by repeated submissions.

Root Cause

The root cause is the use of regular expressions with nested or overlapping quantifiers that lack linear-time guarantees on Python's re engine. When input contains repeating patterns that partially match multiple alternatives, the engine explores an exponential number of backtracking paths. The django-wiki project addressed this by rewriting the affected patterns and refactoring the codehilite extension, including the addition of from textwrap import dedent and structural changes to how raw fenced code blocks are pre-processed.

Attack Vector

The attack vector is network-based and requires no privileges when anonymous article creation or editing is enabled. An attacker submits article content containing the trigger string through the normal create or edit endpoints. The Django worker handling the request stalls inside the vulnerable regex, holding CPU and a process slot until timeout or completion. Coordinated submissions can exhaust the worker pool of a production deployment.

python

+from textwrap import dedent
+
 import logging
 import re

Source: django-wiki commit 8e280fd6 — patch excerpt from src/wiki/core/markdown/mdx/codehilite.py showing the refactor of the codehilite extension that contained the unsafe regular expression handling.

Detection Methods for CVE-2024-28865

Indicators of Compromise

Sustained high CPU utilization on Django application workers correlated with POST requests to django-wiki article create or edit endpoints
Worker processes blocked for seconds to minutes while processing a single article save or preview request
Repeated submissions from a single source containing unusually long or pathological Markdown content
Increased request latency or 5xx errors on wiki routes while other application routes remain responsive

Detection Strategies

Inventory installed Python packages and flag any django-wiki release earlier than 0.10.1
Enable per-request CPU time and duration logging on the Django/WSGI layer to surface outlier request durations
Correlate web access logs for wiki edit endpoints with system metrics showing CPU spikes on the same worker process
Review web application firewall (WAF) logs for request bodies exceeding normal article size or containing repeating token patterns

Monitoring Recommendations

Alert on Python process CPU saturation that persists beyond expected request handling windows
Track p95 and p99 response times for /wiki/_create/, /wiki/_edit/, and preview endpoints
Monitor authentication state of article submitters; anonymous edits are the primary exposure surface
Forward Django application logs and host telemetry to a centralized analytics platform for cross-correlation

How to Mitigate CVE-2024-28865

Immediate Actions Required

Upgrade django-wiki to version 0.10.1 or later in all environments
Disable anonymous article creation and editing until the upgrade is applied
Apply request timeouts at the WSGI server (for example, gunicorn --timeout) to bound the impact of any single slow request
Rate-limit article create, edit, and preview endpoints at the reverse proxy or WAF layer

Patch Information

The fix is delivered in django-wiki 0.10.1, released on 2024-03-16. The relevant change set replaces the vulnerable regular expressions and restructures Markdown extension handling. Details are available in GitHub Security Advisory GHSA-wj85-w4f4-xh8h and commit 8e280fd6c0bd27ce847c67b2d216c6cbf920f88c.

Workarounds

Restrict article create and edit permissions to authenticated, trusted users only
Place the wiki behind authentication middleware or a reverse-proxy access control list
Enforce a maximum request body size and per-request CPU/time limits at the application server
Deploy WAF rules that block submissions exhibiting pathological repetition patterns

bash

# Upgrade django-wiki to the patched release
pip install --upgrade 'django-wiki>=0.10.1'

# Verify the installed version
python -c "import wiki; print(wiki.__version__)"

# Example gunicorn run with a request timeout to bound ReDoS impact
gunicorn myproject.wsgi:application --workers 4 --timeout 15