CVE-2025-48432: Django Log Injection Vulnerability

CVE-2025-48432 Overview

An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

Critical Impact

Remote attackers can inject malicious content into application logs through crafted URL paths, potentially leading to log forgery, terminal manipulation, or exploitation of downstream log processing systems.

Affected Products

• Django versions 5.2 before 5.2.3
• Django versions 5.1 before 5.1.11
• Django versions 4.2 before 4.2.23
• Debian Linux 11.0

Discovery Timeline

• June 4, 2025 - Django Project releases security advisory
• June 5, 2025 - CVE CVE-2025-48432 published to NVD
• October 15, 2025 - Last updated in NVD database

Technical Details for CVE-2025-48432

Vulnerability Analysis

This vulnerability is classified as CWE-117 (Improper Output Neutralization for Logs), a log injection flaw affecting Django's internal HTTP response logging mechanism. The core issue stems from the framework's failure to properly escape or sanitize the request.path value before writing it to application logs.

When Django logs HTTP responses, the request path is included in the log output without adequate sanitization. An attacker can craft URLs containing special characters, ANSI escape sequences, or newline characters that get written directly into the log files. This can result in several attack scenarios including log entry forgery (creating fake log entries that appear legitimate), terminal manipulation when logs are viewed in consoles, and potential exploitation of log parsing systems that process these logs downstream.

The attack is network-accessible and requires no authentication or user interaction, making it relatively easy to exploit across the internet against vulnerable Django deployments.

Root Cause

The root cause lies in Django's HTTP response logging functionality, which directly incorporates the request.path value into log messages without proper output neutralization. The logging code fails to escape special characters such as newlines (\n), carriage returns (\r), and ANSI escape sequences before writing to log files. This oversight allows attackers to inject arbitrary content into logs by including these characters in URL paths.

Attack Vector

The attack is executed remotely over the network by sending HTTP requests with specially crafted URL paths to a vulnerable Django application. An attacker constructs URLs containing malicious payloads embedded in the path component, such as newline characters to inject fake log entries, ANSI escape codes to manipulate terminal output when logs are viewed, or crafted content designed to exploit log aggregation and analysis tools.

When the Django application processes these requests and logs the HTTP response, the unsanitized path content is written directly to the logs, enabling the attacker's payload to execute its intended effect.

Detection Methods for CVE-2025-48432

Indicators of Compromise

• Unusual characters or escape sequences appearing in HTTP access logs
• Log entries containing unexpected newline characters or ANSI codes
• Suspicious URL patterns with encoded special characters in request paths
• Anomalous log formatting or unexpected log entries appearing out of sequence

Detection Strategies

• Implement log integrity monitoring to detect injected or malformed log entries
• Deploy web application firewalls (WAF) to filter requests containing suspicious characters in URL paths
• Monitor for HTTP requests with unusual URL encoding patterns targeting Django applications
• Review application logs for evidence of terminal escape sequences or control characters

Monitoring Recommendations

• Enable verbose logging for Django applications and correlate with web server access logs
• Configure SIEM systems to alert on log entries containing control characters or escape sequences
• Implement application-level monitoring for requests with abnormal URL path patterns
• Regularly audit log files for signs of tampering or injection attempts

How to Mitigate CVE-2025-48432

Immediate Actions Required

• Upgrade Django to version 5.2.3, 5.1.11, or 4.2.23 or later immediately
• Review existing logs for potential evidence of exploitation attempts
• Implement input validation at the web server level to filter malicious URL patterns
• Consider deploying a WAF with rules to block requests containing control characters in paths

Patch Information

Django Project has released security patches addressing this vulnerability. Organizations should upgrade to the following patched versions:

• Django 5.2.3 or later for the 5.2.x branch
• Django 5.1.11 or later for the 5.1.x branch
• Django 4.2.23 or later for the 4.2.x branch

Patch details and release notes are available via the Django Security Releases Documentation and the Django Weblog Security Releases announcement.

Workarounds

• Implement custom middleware to sanitize request.path before logging
• Configure web server or reverse proxy to reject URLs containing control characters
• Use log sanitization at the log aggregation layer to strip dangerous characters
• Disable verbose HTTP response logging temporarily until patches can be applied

# Example: Upgrade Django to patched version
pip install --upgrade Django>=5.2.3

# Verify installed version
python -c "import django; print(django.get_version())"