CVE-2023-46695: Django NFKC Normalization DoS Vulnerability
Summary
CVE-2023-46695: An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. Affects django across 3 version ranges.
>= 3.2.0, < 3.2.23
>= 4.1.0, < 4.1.13
>= 4.2.0, < 4.2.7
Fixed in 3.2.23, 4.1.13 or 4.2.7, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2023-46695 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular open-source web framework written in Python. It provides a set of tools and libraries for building web applications quickly and efficiently. The affected package, Django, is widely used in various web development projects. This vulnerability specifically affects versions 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7 of Django. The vulnerability arises from the slow NFKC normalization process on Windows, which can be exploited to launch a denial of service (DoS) attack on the django.contrib.auth.forms.UsernameField component. Attackers can achieve this by submitting inputs with an excessive number of Unicode characters.
Vulnerability Detail
The NFKC normalization process in Django is slow on Windows, making the django.contrib.auth.forms.UsernameField component susceptible to a potential DoS attack. By submitting inputs with a large number of Unicode characters, an attacker can overwhelm the normalization process, causing a significant performance degradation or even a complete denial of service. This vulnerability can impact the availability and responsiveness of Django-based web applications.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.2.0, < 3.2.233.2.23 -
>= 4.1.0, < 4.1.134.1.13 -
>= 4.2.0, < 4.2.74.2.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and rate limiting mechanisms to mitigate the impact of potential DoS attacks. By enforcing restrictions on the length and complexity of input strings, the risk of triggering the slow NFKC normalization process can be reduced. Additionally, implementing rate limiting measures can help prevent an excessive number of requests from overwhelming the system.
Conclusion
In conclusion, the NFKC normalization DoS vulnerability in Django can be exploited to launch a denial of service attack on the django.contrib.auth.forms.UsernameField component. Upgrading to the fixed versions of Django is the recommended solution. Implementing input validation and rate limiting mechanisms can serve as temporary workarounds. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
This vulnerability can lead to a denial of service (DoS) attack on Django-based web applications, causing performance degradation or unresponsiveness.
Versions 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7 of Django are affected by this vulnerability.
To fix this vulnerability, upgrade Django to version 3.2.23, 4.1.13, or 4.2.7. Follow the upgrade instructions provided by the Django project.
Implement input validation and rate limiting mechanisms to mitigate the impact of potential DoS attacks. Enforce restrictions on input length and complexity, and implement rate limiting measures.
For more information about this vulnerability, refer to the CVE identifier CVE-2023-46695 and the Django project's security advisories.
Related vulnerabilities
Recent vulnerabilities recorded for django.
