Denial of Service Vulnerability in Django Session Middleware
Summary
CVE-2015-5963: contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consum... Affects python-django versions < 1.7.10-1. Fixed in 1.7.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an authentication system, URL routing, and a powerful ORM. The SessionMiddleware component manages user sessions, allowing developers to store and retrieve user data across requests. However, certain versions of Django are vulnerable to a denial of service attack due to improper handling of session records, which can be exploited by sending numerous requests to the logout view.
Vulnerability Detail
The vulnerability, identified as CVE-2015-5963, affects Django versions 1.8.x before 1.8.4, 1.7.x before 1.7.10, and 1.4.x before 1.4.22. It allows remote attackers to consume session store resources or remove session records by triggering the creation of empty session records through repeated requests to the contrib.auth.views.logout endpoint. This can lead to denial of service, impacting the availability of the application.
How To Fix
Minimum fixed version
1.7.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot upgrade immediately, consider implementing rate limiting on the logout endpoint to mitigate the risk of denial of service attacks. This can be done using middleware or a third-party package that restricts the number of requests from a single IP address within a specified timeframe.
Conclusion
CVE-2015-5963 is a significant vulnerability in certain versions of Django that can lead to denial of service through session record manipulation. It is crucial for developers to upgrade to the latest versions of Django to mitigate this risk. Additionally, implementing rate limiting can serve as a temporary measure while preparing for an upgrade.
See every vulnerability recorded for python-django →
FAQ
CVE-2015-5963 is a vulnerability in Django that allows attackers to cause denial of service by exploiting the session middleware.
Django versions 1.8.x before 1.8.4, 1.7.x before 1.7.10, and 1.4.x before 1.4.22 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to denial of service, making your application unavailable to legitimate users.
Implement rate limiting on the logout endpoint as a temporary workaround to reduce the risk of denial of service attacks.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
