CVE-2020-35681: Django Channels Information Leakage
Summary
CVE-2020-35681: Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. Affects channels versions >= 3.0.0, < 3.0.3. Fixed in 3.0.3. How to fix ↓
Also tracked for
- python-django-channels · Debian:11
The same CVE-2020-35681 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django Channels is a Python package that extends Django to handle WebSockets, HTTP, and other asynchronous protocols. It provides a way to handle multiple connections and events concurrently, making it suitable for real-time applications. The vulnerability identified as CVE-2020-35681 affects Django Channels versions 3.x before 3.0.3. This vulnerability allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channels 3.0. This could result in a crash or, with correct timing, responses being sent to the wrong client, potentially leaking session identifiers and other sensitive data. It's important to note that this vulnerability only affects the legacy Channels provided class and not Django's similar ASGIHandler available from Django 3.0.
Vulnerability Detail
The vulnerability in Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. By exploiting the incorrect separation of request scopes in the legacy channels.http.AsgiHandler class, an attacker could potentially send responses to the wrong client, leading to the leakage of session identifiers and other sensitive data. This vulnerability poses a risk to the confidentiality and integrity of user data and can be exploited remotely.
How To Fix
Minimum fixed version
3.0.3
This is the first release that contains the fix.
pip install --upgrade "channels==3.0.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the fixed version of Django Channels to mitigate the risk of information leakage.
Conclusion
The vulnerability in Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope, potentially leading to unauthorized access and data breaches. To mitigate this risk, it is crucial to upgrade to Django Channels version 3.0.3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for channels →
FAQ
Django Channels versions 3.x before 3.0.3 are affected by this vulnerability.
The vulnerability allows remote attackers to obtain sensitive information, such as session identifiers, from a different request scope. This can lead to unauthorized access and potential data breaches.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of Django Channels.
To upgrade Django Channels, update the package in your project's dependencies to version 3.0.3 or later. Make sure the updated version is installed.
You can find more information about this vulnerability in the official Django Channels advisory: [link to advisory].
