Company
Date Published
Author
Dennis Brinkrolf
Word count
3247
Language
English
Hacker News points
None

Summary

The Django framework has a vulnerable variable resolution logic in its dictsort filter, which can be exploited to extract sensitive information such as password hashes. An attacker can use this vulnerability by sorting users based on the first character, second character, and third character of their password hash, allowing them to determine the complete hash with only three requests. This exploit works because the dictsort filter uses a custom function that resolves variables, but does not prevent calling arbitrary methods or instantiating objects without parameters. The Django maintainers have released patches for versions 2.2.26, 3.2.11, and 4.0.1 to address this vulnerability, which has been assigned CVE-2021-45116 with a CVSS score of 7.5 (High). It is recommended that users upgrade to a secure version of Django to prevent this risk.