CVE-2010-4535: Django denial of service in password reset timestamp handling

Executive brief

A vulnerability in the Django web framework's password reset system could allow an attacker to crash the application. By sending a specially crafted web request with an extremely long timestamp, an attacker can force the server to consume excessive system resources. This can lead to a denial of service, making the website unavailable to legitimate users.

Technical details

The vulnerability exists within the 'django.contrib.auth' component of the Django web framework. Specifically, the password reset mechanism does not perform length validation on the string representing a base36 timestamp provided in the reset URL. A remote, unauthenticated attacker can exploit this by submitting a URL containing an arbitrarily large base36 integer, leading to excessive CPU and memory consumption during processing. This resource exhaustion results in a denial of service (DoS) condition. The issue is resolved in Django versions 1.1.3, 1.2.4, and 1.3 beta 1.

Affected products

• Django Project Django < 1.1.3, >= 1.2, < 1.2.4, 1.3 beta 1

Timeline

• 2010-12-22: advisory: Django security release announcement
• 2011-01-10: disclosed: NVD publication date
• 2018-07-23: advisory: GitHub Advisory published

References

• https://api.github.com/users/MarkLee131
• https://github.com/MarkLee131
• https://api.github.com/users/MarkLee131/gists%7B/gist_id%7D
• https://api.github.com/users/MarkLee131/repos
• https://avatars.githubusercontent.com/u/38575222?v=4
• https://api.github.com/users/MarkLee131/events%7B/privacy%7D