Sensitive Data Exposure in Django Channels 3.x - CVE-2020-35681
Summary
CVE-2020-35681: Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. Affects python-django-channels across 2 version ranges.
< 3.0.3-1
>= 3ab3f42d34da51e4d7c514c88ce6f49b722c58bf, < 87ab4010ef564cbca3069e0704ef02b512c5cb42
Fixed in 3.0.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django Channels is an extension of the Django web framework that adds support for handling asynchronous protocols such as WebSockets. It allows developers to build real-time applications with ease. The package is widely used in applications that require long-lived connections and real-time updates. However, a vulnerability was discovered in the legacy AsgiHandler class, which could lead to sensitive data exposure.
Vulnerability Detail
CVE-2020-35681 affects Django Channels 3.x versions prior to 3.0.3. The vulnerability arises from improper separation of request scopes in the legacy channels.http.AsgiHandler class. This flaw allows remote attackers to potentially send responses to the wrong client, leading to leakage of sensitive information such as session identifiers. The issue primarily affects applications using the legacy handler before the introduction of Django's ASGIHandler in version 3.0.
How To Fix
Minimum fixed version
3.0.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-django-channelsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider switching to Django's ASGIHandler for handling HTTP requests, which does not have this vulnerability. Modify your application to use the ASGIHandler instead of the legacy AsgiHandler.
Conclusion
CVE-2020-35681 is a significant vulnerability in Django Channels that can lead to sensitive data exposure. It is crucial for developers using affected versions to upgrade to 3.0.3 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python-django-channels →
FAQ
CVE-2020-35681 is a vulnerability in Django Channels that allows remote attackers to obtain sensitive information due to improper request scope separation.
If your application uses the legacy AsgiHandler in Django Channels 3.x, it may expose sensitive data such as session identifiers to unauthorized clients.
Django Channels versions prior to 3.0.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2020-35681 is 7.4, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django-channels.
