Listen to this Post
How the CVE Works:
The vulnerability occurs in Django’s `HeavySelect2Mixin` subclasses (ModelSelect2MultipleWidget and ModelSelect2Widget), where improperly handled widget instances leak access tokens across HTTP requests. Attackers can exploit this by intercepting these tokens, gaining unauthorized access to restricted querysets and sensitive data. The leak happens when widget instances are initialized during app loading instead of per-request, causing token persistence.
DailyCVE Form:
Platform: Django
Version: <8.4.1
Vulnerability: Token Leak
Severity: Critical
Date: 2023-XX-XX
Prediction: Patch expected by 2023-XX-XX
What Undercode Say:
Analytics:
- Exploitability: High (token reuse)
- Attack Vector: Remote
- Affected Configs: HeavySelect2Mixin usage
Exploit (PoC):
Malicious request capturing leaked token
import requests
leaked_token = extract_token_from_response(previous_response)
headers = {'Authorization': f'Token {leaked_token}'}
response = requests.get('https://target.com/restricted-data', headers=headers)
Protection:
1. Patch Immediately: Upgrade to Django-Select2 >=8.4.1.
- Code Mitigation: Replace widget instances with class references:
Before (vulnerable): widgets = {"field": ModelSelect2Widget()} After (fixed): widgets = {"field": ModelSelect2Widget}
3. Network Controls:
Block suspicious token reuse (iptables example) iptables -A INPUT -p tcp --dport 443 -m string --string "old_token" --algo bm -j DROP
4. Log Monitoring:
Detect token leaks in logs grep -E "access_token|HeavySelect2" /var/log/django/error.log
5. Django Middleware Fix:
class TokenSanitizerMiddleware:
def process_response(self, request, response):
if hasattr(response, 'data') and 'token' in response.data:
response.data.pop('token', None)
return response
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
