Django < 3.0 < 2.2 < 1.11 - Account Hijack

🗓️ 24 Dec 2019 00:00:00Reported by Ryuji TsutsuiType

exploitdb🔗 www.exploit-db.com👁 153 Views

Django < 3.0 < 2.2 < 1.11 - Account Hijack, PoC for CVE-2019-19844, Setup for reproducing account hijack exploit

Reporter	Title	Published	Views	Family All 155
0day.today	Django < 3.0 < 2.2 < 1.11 - Account Hijack Vulnerability	24 Dec 201900:00	–	zdt
Gitee	Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform	8 Dec 202020:38	–	gitee
GithubExploit	Exploit for Weak Password Recovery Mechanism for Forgotten Password in Djangoproject Django	21 Dec 201904:30	–	githubexploit
GithubExploit	Exploit for Weak Password Recovery Mechanism for Forgotten Password in Djangoproject Django	18 Jan 202013:32	–	githubexploit
GithubExploit	Exploit for Weak Password Recovery Mechanism for Forgotten Password in Djangoproject Django	25 Dec 201910:05	–	githubexploit
AlpineLinux	CVE-2019-19844	18 Dec 201918:07	–	alpinelinux
ALT Linux	Security fix for the ALT Linux 10 package python3-module-django version 2.2.12-alt1	12 Apr 202000:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 9 package python3-module-django version 2.2.12-alt1	12 Apr 202000:00	–	altlinux
Circl	CVE-2019-19844	24 Dec 201900:00	–	circl
CNVD	Django Account Hijacking Vulnerability	19 Dec 201900:00	–	cnvd

EDB Note ~ Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47879.zip


# django_cve_2019_19844_poc
PoC for [CVE-2019-19844](https://www.djangoproject.com/weblog/2019/dec/18/security-releases/)

# Requirements

- Python 3.7.x
- PostgreSQL 9.5 or higher

## Setup

1. Create database(e.g. `django_cve_2019_19844_poc`)
1. Set the database name to the environment variable `DJANGO_DATABASE_NAME`(e.g. `export DJANGO_DATABASE_NAME=django_cve_2019_19844_poc`)
1. Run `pip install -r requirements.txt && ./manage.py migrate --noinput`
1. Create the following user with `shell` command:

```python
>>> from django.contrib.auth import get_user_model
>>> User = get_user_model()
>>> User.objects.create_user('mike123', '[email protected]', 'test123')
```

## Procedure For Reproducing

1. Run `./manage.py runserver`
1. Open `http://127.0.0.1:8000/accounts/password-reset/`
1. Input `mı[email protected]` (Attacker's email), and click send button
1. Receive email (Check console), and reset password
1. Login as `mike123` user

24 Dec 2019 00:00Current

9.6High risk

Vulners AI Score9.6

CVSS 25

CVSS 3.19.8

EPSS0.15418

Django &lt; 3.0 &lt; 2.2 &lt; 1.11 - Account Hijack

Django < 3.0 < 2.2 < 1.11 - Account Hijack