Disclosing information with a side-channel in Django

The Django framework has a vulnerable variable resolution logic in its dictsort filter, which can be exploited to extract sensitive information such as password hashes. An attacker can use this vulnerability by sorting users based on the first character, second character, and third character of their password hash, allowing them to determine the complete hash with only three requests. This exploit works because the dictsort filter uses a custom function that resolves variables, but does not prevent calling arbitrary methods or instantiating objects without parameters. The Django maintainers have released patches for versions 2.2.26, 3.2.11, and 4.0.1 to address this vulnerability, which has been assigned CVE-2021-45116 with a CVSS score of 7.5 (High). It is recommended that users upgrade to a secure version of Django to prevent this risk.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.