July 2022 Summaries

The Django framework has a vulnerable variable resolution logic in its dictsort filter, which can be exploited to extract sensitive information such as password hashes. An attacker can use this vulnerability by sorting users based on the first character, second character, and third character of their password hash, allowing them to determine the complete hash with only three requests. This exploit works because the dictsort filter uses a custom function that resolves variables, but does not prevent calling arbitrary methods or instantiating objects without parameters. The Django maintainers have released patches for versions 2.2.26, 3.2.11, and 4.0.1 to address this vulnerability, which has been assigned CVE-2021-45116 with a CVSS score of 7.5 (High). It is recommended that users upgrade to a secure version of Django to prevent this risk.

This vulnerability in Blitz.js, a full-stack React framework, allows attackers to execute code on servers that run applications based on vulnerable versions of the software. The issue arises from the implementation of superjson, an extended version of JSON used for deserialization of RPC call arguments. This library introduces support for more data types and circular dependencies, which can lead to Prototype Pollution vulnerabilities. Attackers can exploit this by sending a request that abuses the Prototype Pollution issue in the RPC layer, adding properties to the Object prototype. The vulnerability can be chained with other issues, such as spawning new processes or executing arbitrary code using Node.js. To fix the issue, Blitz.js has released patches for superjson 1.8.1 and Blitz.js 0.45.3, which include fixes for Prototype Pollution vulnerabilities. Developers are strongly advised to update their dependencies to these fixed versions to prevent exploitation of this vulnerability. Additionally, hardening codebases by making Object.prototype immutable or using Object.create(null) can make the exploitation of Prototype Pollution issues more difficult. However, these measures come with drawbacks and may break existing libraries or functionality.