Internet Bug Bounty · Report #2258758

CVE-2023-46695: Potential denial of service vulnerability in UsernameField on Windows

Validstatus

mediumseverity

$2,540bounty

28upvotes

29 Nov 2023disclosed

Summary

CVE-2023-46695: Potential denial of service vulnerability in UsernameField on Windows The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField was subject to a potential denial of service attack via certain inputs with a very large number of Unicode characters.

In order to avoid the vulnerability, invalid values longer than UsernameField.max_length are no longer normalized, since they cannot pass validation anyway.

Thanks MProgrammer for the report.

This issue has severity "moderate" according to the Django security policy.

Full Security Advisory: https://www.djangoproject.com/weblog/2023/nov/01/security-releases/

How it was found

In Django versions before 4.2.7, 4.1.13, and 3.2.23, I sent a POST request to the admin login page using Burp Suite, editing the request to send over 1 million invalid unicode characters to my local web server running Django. (I used: "¾") After submitting, a single request took 4.4 seconds on average. When I sent 20 concurrent requests, then I got 60 second wait times, and 504 gateway timeout errors on my machine. {F2871465} Normal ascii characters don't do this and the page loads instantly.

Impact

Denial of Service anywhere a form contains a UsernameField that checks for errors.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original