PT-2023-24202 · Unknown · Django-Ses

Josephsurin · Published 2023-05-22 · Updated 2023-06-06 · CVE-2023-33185

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Django-SES versions prior to 3.5.0

Description The django ses library, a mail backend for Django using AWS Simple Email Service, has a flaw in the verification of signed requests from AWS. The SESEventWebhookView class is intended to handle email bounces, subscriptions, etc., but the verification of the signature allowed users to specify arbitrary public certificates.

Recommendations For versions prior to 3.5.0, update to version 3.5.0 to resolve the issue. As a temporary workaround, consider restricting access to the SESEventWebhookView class until the update is applied.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2023-33185

GHSA-QG36-9JXH-FJ25

PYSEC-2023-82

Affected Products

Django-Ses

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33185.json · Exploit
• 🔥 https://github.com/django-ses/django-ses/blob/3d627067935876487f9938310d5e1fbb249a7778/CVE/001-cert-url-signature-verification.md · Exploit
• https://github.com/django-ses/django-ses/security/advisories/GHSA-qg36-9jxh-fj25 · Vendor Advisory
• https://github.com/django-ses/django-ses/commit/b71b5f413293a13997b6e6314086cb9c22629795 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-33185 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-82 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qg36-9jxh-fj25 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-33185 · Vendor Advisory
• https://github.com/django-ses/django-ses · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/django-ses/PYSEC-2023-82.yaml · Note