Description

This detector identifies insecure Django configurations that can allow user-controlled input to modify SDK or framework settings. When user input is used to configure Django components, attackers may manipulate application behavior, access sensitive data, or execute unauthorized operations through configuration tampering.

Detection Strategy

• Identifies Django-related configuration code patterns where user input influences SDK or framework settings

• Scans for configurations that accept external input from HTTP requests, form data, URL parameters, or other user-controllable sources

• Flags instances where Django components, middleware, or application settings are modified based on user-provided values

• Reports vulnerabilities when configuration parameters can be manipulated by attackers to alter application security policies or behavior

Vulnerable code example

import os
import boto3
import redis
from django.http import HttpResponse

def connect_aws(request):
    endpoint = request.GET.get("endpoint")
    # VULNERABLE: AWS credentials sent to user-controlled endpoint...

✅ Secure code example

import os
import boto3
import redis
from django.http import HttpResponse
from django.http import HttpResponseForbidden

# Define allowlisted endpoints for security
ALLOWED_AWS_ENDPOINTS = {...