Listen to this Post
The `move_plugin` admin endpoint in django CMS prior to version 5.0.8 contains a vulnerability that allows an authenticated staff user to corrupt the plugin tree, leading to a denial of service. The vulnerability arises because the endpoint does not prevent a plugin from being moved under itself or one of its own descendants. When an attacker-controlled `plugin_parent` value is provided, the plugin’s `parent_id` is updated without any cycle or ancestor check, creating a cycle in the parent-child graph.
The descendant and ancestor traversal in django CMS is implemented using `WITH RECURSIVE` Common Table Expressions (CTEs) in the `_get_descendants_cte` and `_get_ancestors_cte` functions within cms/models/pluginmodel.py. These recursive queries lack a cycle clause or depth limit. On a cyclic tree, these queries will recurse indefinitely on databases like PostgreSQL and SQLite, or hit the recursion limit on MySQL. The `get_descendants()` function is invoked both while building the response to the move request and on any subsequent operations on the affected subtree, such as rendering, copying, or deleting plugins.
An attacker with staff privileges and the CMS_PERMISSION/plugin-change permission on at least one placeholder can exploit this. By crafting a malicious move request, they can corrupt the plugin tree, causing any request that traverses it to hang and consume application workers. This effectively creates a denial-of-service condition, as the tree is left in a corrupted state, and no workaround exists other than upgrading.
DailyCVE Form:
Platform: django CMS
Version: < 5.0.8
Vulnerability: Cyclic Reparenting DoS
Severity: High (CVSS 7.1)
date: 2026-08-20
Prediction: Already Patched (2026-06-10)
What Undercode Say:
- Analytics:
- Vulnerability Type: Denial of Service (DoS) via Uncontrolled Recursion
- Attack Vector: Network
- Privileges Required: Low (Staff user)
- User Interaction: None
- Impact: High Availability, Low Integrity
- EPSS: 0.34% (Very low exploit probability)
- Bash commands and codes related to the blog
- Check django CMS version:
python -c "import django; print(django.get_version())"
or
pip show django-cms | grep Version
– Check if vulnerable version is installed:
pip show django-cms | grep Version | awk '{print $2}' | while read v; do if [[ "$v" < "5.0.8" ]]; then echo "Vulnerable version: $v"; fi; done
– Upgrade to patched version:
pip install django-cms>=5.0.8
Exploit: (Educational Purposes!)
- Step 1: Identify a plugin and its descendant. For example, plugin with `id=1` has a child plugin with
id=2. - Step 2: As a staff user with plugin-change permissions, send a POST request to the `move_plugin` admin endpoint with `plugin_id=2` and `plugin_parent=2` (or `plugin_id=2` and `plugin_parent=1` if 1 is the descendant).
- Step 3: The vulnerable endpoint accepts this request without validation, creating a cycle where plugin 2 is its own parent.
- Step 4: The recursive CTE used for traversal will now loop indefinitely on any subsequent request that accesses this subtree.
Protection:
- Immediate: Upgrade to django CMS version 5.0.8 or later.
- If unable to upgrade: No effective workaround exists. Restrict staff access to the admin interface and monitor for unusual plugin move activities.
Impact:
- Denial of Service: Application workers become consumed by infinite recursive SQL queries, rendering the application unresponsive for all users.
- Corrupted Data: The plugin tree is left in a corrupted state, which may require manual database intervention to repair.
- Availability: The primary impact is on the availability of the CMS, with a CVSS score of 7.1 (High).
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
