Listen to this Post
Django REST Framework (DRF) is a powerful and flexible toolkit for building Web APIs. Prior to version 3.17.2, a vulnerability existed in the `AdminRenderer` component that could lead to the disclosure of sensitive information.
The core of the issue lies in how the `AdminRenderer.render()` method handles invalid write requests (e.g., a `POST` request with invalid data). When such a request is received and the client negotiates the HTML renderer (for example, by using an `Accept: text/html` header), the rendering process takes an unconventional path.
Instead of simply returning the validation errors, the `AdminRenderer` temporarily overrides the request method to `GET` using the `override_method()` function and directly invokes the view’s `get()` handler. This is a critical deviation from the normal request-processing flow.
Under normal circumstances, a standard `GET` request would be processed through the `APIView.dispatch()` method, which includes a call to APIView.check_permissions(). This ensures that the requesting user has the necessary permissions before any data is retrieved or rendered.
However, the path taken by the `AdminRenderer` completely bypasses this security checkpoint. It calls `view.get()` directly, without performing the corresponding permission checks. Consequently, if a view has a permission class that explicitly allows `POST` requests but denies `GET` requests, the `GET` handler will still be executed during the rendering of an invalid `POST` request.
This results in a 400 Bad Request HTML response that includes data from the `GET` representation—data that the requester should not be permitted to access. The issue is specific to the `AdminRenderer` and does not affect the standard JSON rendering path or successful write requests.
DailyCVE Form:
Platform: Django REST Framework
Version: <3.17.2
Vulnerability: Information Disclosure
Severity: Medium (CVSS 4.3)
date: 2026-08-11
Prediction: Patch already available in v3.17.2
What Undercode Say:
The vulnerability exists in rest_framework/renderers.py. The `AdminRenderer.render()` method uses `override_method()` to simulate a `GET` request and calls `view.get()` without checking permissions. This allows a 400 Bad Request HTML response to leak data from a `GET` representation that the requester should not access. To reproduce, one can create a view with a permission class that allows `POST` but denies GET, enable AdminRenderer, and send an invalid `POST` request with an `Accept: text/html` header.
Bash PoC
Send an invalid POST request while requesting an HTML response curl -X POST http://target-api.example.com/endpoint/ \ -H "Accept: text/html" \ -d "invalid_data=1"
Exploit: (Educational Purposes!)
To understand this vulnerability, consider the following simplified code example.
Vulnerable Permission Class:
from rest_framework.permissions import BasePermission class ProbePermission(BasePermission): def has_permission(self, request, view): Only POST requests are allowed; GET is denied. return request.method == "POST"
Vulnerable View:
from rest_framework.generics import ListCreateAPIView
from rest_framework.renderers import AdminRenderer, JSONRenderer
from rest_framework.response import Response
class View(ListCreateAPIView):
renderer_classes = [AdminRenderer, JSONRenderer]
permission_classes = [bash]
serializer_class = ProbeSerializer
def get_queryset(self):
This data is only intended for authorized GET requests.
return [{"name": "visible", "secret": "GET-ONLY-SECRET"}]
Exploitation Steps:
- An attacker sends a `POST` request with invalid data to the `/endpoint/` URL.
- The attacker sets the `Accept` header to `text/html` to force the `AdminRenderer` to be used.
- Because the request is invalid, the server attempts to render a 400 Bad Request response.
- The `AdminRenderer` simulates a `GET` request and calls `view.get()` without checking permissions.
- The `GET` handler retrieves the protected data (including the `”secret”` field) and includes it in the HTML error response.
- The attacker receives the HTML response containing the
GET-ONLY-SECRET, which they are not authorized to view.
Protection:
The primary and recommended mitigation is to upgrade to Django REST Framework version 3.17.2 or later, where this vulnerability has been patched.
– Upgrade Command: `pip install djangorestframework –upgrade`
– Verify Version: `python -m pip show djangorestframework`
No other temporary workarounds or mitigations are indicated. It is also advisable to review application error handling to ensure all renderers enforce proper authorization checks.
Impact:
This vulnerability can lead to information disclosure when the following conditions are met:
– `AdminRenderer` is enabled.
– The client negotiates the HTML renderer (e.g., using Accept: text/html).
– The application permits `POST` (or another write method).
– `GET` requests are denied by the configured permission class.
– An invalid write request returns a 400 Bad Request.
– The `GET` representation contains information the requester would not normally be permitted to access.
The issue does not affect:
- JSON rendering.
- Standard API responses.
- Successful write requests.
The behavior is limited to the HTML rendering path used byAdminRenderer. An attacker with limited privileges can cause the server to expose sensitive data, impacting the confidentiality of the system.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
