PT-2021-11824 · Django · Django Channels

Published 2021-02-22 · Updated 2021-03-19 · CVE-2020-35681

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Django Channels versions 3.0.0 through 3.0.2

Description: The legacy channels.http.AsgiHandler class in Django Channels did not correctly separate request scopes, potentially allowing remote attackers to obtain sensitive information from a different request scope. This could result in a crash, but with correct timing, responses could be sent to the wrong client, leading to potential leakage of session identifiers and other sensitive data. This issue affects only the legacy Channels provided class and not Django's similar ASGIHandler available from Django 3.0.

Recommendations: For Django Channels versions 3.0.0 through 3.0.2, update to version 3.0.3 or later to resolve the issue. As a temporary workaround, consider disabling the legacy channels.http.AsgiHandler class until a patch is available. Restrict access to sensitive data and session identifiers to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2020-35681

GHSA-V542-8Q9X-CFFC

PYSEC-2021-113

Affected Products

Django Channels

References · 19

• 🔥 https://channels.readthedocs.io/en/stable/releases/3.0.3.html · Exploit
• https://osv.dev/vulnerability/GHSA-v542-8q9x-cffc · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-113 · Vendor Advisory
• https://channels.readthedocs.io/en/stable/releases/index.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35681 · Security Note
• https://ubuntu.com/security/CVE-2020-35681 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-35681 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-35681 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35681 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-35681 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-35681 · Vendor Advisory
• https://github.com/django/channels/releases · Note
• https://github.com/django/channels · Note
• https://github.com/django/channels/commit/e85874d9630474986a6937430eac52db79a2a022 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/channels/PYSEC-2021-113.yaml · Note