CVE-2008-3909: CSRF
Description of problem: The following was reported today to the public (Sept, 2, 2008) via the Django main site:
The Django administration application, as a convenience for users whose sessions expire, will attempt to preserve HTTP POST data from an incoming submission while re-authenticating the user, and will -- on successful authentication -- allow the submission to continue without requiring data to be re-entered.
Django developer Simon Willison has presented the Django development team with a proof-of-concept cross-site request forgery (CSRF) which exploits this behavior to perform unrequested deletion/modification of data. This exploit has been tested and verified by the Django team, and succeeds regardless of whether Django's bundled CSRF-protection module is active.
Version-Release number of selected component (if applicable): Django-0.96.2-1
Extra Info Since I am not aware if the maintainer of the package was given advance notice I'm cc'ing him on this bug.
Other sources
The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.
— MITRE
The administration application in Django 0.91.x, 0.95.x, and 0.96.x stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.
— GitHub
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-3909?
CVE-2008-3909 is classified as a medium-severity vulnerability that may lead to unauthorized data exposure.
How can I mitigate CVE-2008-3909?
To mitigate CVE-2008-3909, it is recommended to upgrade Django to version 0.96.4 or higher.
Which versions of Django are affected by CVE-2008-3909?
CVE-2008-3909 affects Django versions from 0.91 up to 0.96.3 inclusive.
Is CVE-2008-3909 exploitable remotely?
Yes, CVE-2008-3909 can be exploited remotely by an attacker to access sensitive data.
What specific impact does CVE-2008-3909 have on applications using Django?
CVE-2008-3909 potentially allows attackers to capture and reuse user session data across requests.