CVE-2023-46695: Djangoproject Django DoS Vulnerability

CVE-2023-46695 Overview

CVE-2023-46695 is a Denial of Service (DoS) vulnerability discovered in Django, the popular Python web framework. The vulnerability exists in the NFKC normalization process used by django.contrib.auth.forms.UsernameField, which exhibits slow performance on Windows systems. An attacker can exploit this weakness by submitting specially crafted inputs containing a very large number of Unicode characters, causing significant resource exhaustion and service degradation.

Critical Impact
Attackers can cause denial of service conditions on Django applications running on Windows by sending malicious username inputs with excessive Unicode characters, potentially rendering authentication systems unavailable.

Affected Products

Django 3.2 before 3.2.23
Django 4.1 before 4.1.13
Django 4.2 before 4.2.7

Discovery Timeline

2023-11-01 - Django releases security patches
2023-11-02 - CVE-2023-46695 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-46695

Vulnerability Analysis

This vulnerability stems from the way Django handles Unicode normalization using the NFKC (Normalization Form Compatibility Composition) algorithm within the UsernameField form field. When processing user-supplied input, Django normalizes Unicode characters to ensure consistent representation. However, on Windows systems, the underlying NFKC normalization implementation exhibits significantly slower performance when handling inputs with an exceptionally large number of Unicode characters.

The weakness is classified under CWE-770 (Allocation of Resources Without Limits or Throttling), indicating that the application fails to properly limit resource consumption during the normalization process. This allows attackers to craft inputs that consume disproportionate CPU time and system resources.

Root Cause

The root cause lies in the performance characteristics of NFKC Unicode normalization on Windows platforms. The django.contrib.auth.forms.UsernameField class performs normalization on user-supplied username input without adequate restrictions on the complexity or length of Unicode character sequences. When an attacker submits input containing massive Unicode character sequences, the normalization algorithm consumes excessive computational resources, leading to application slowdown or unresponsiveness.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

Identifying Django applications running on Windows servers that expose user registration or login forms
Crafting HTTP requests containing username fields with extremely large numbers of Unicode characters
Submitting these malicious requests to the target application's authentication endpoints
Repeating the requests to amplify the resource exhaustion effect

The vulnerability affects any Django application using the standard UsernameField form field on Windows systems where the authentication forms are publicly accessible.

Detection Methods for CVE-2023-46695

Indicators of Compromise

Abnormal CPU utilization spikes coinciding with authentication form submissions
Unusually long HTTP request processing times for login or registration endpoints
Web server access logs showing POST requests to authentication URLs with extremely large request body sizes
Application performance degradation isolated to user authentication functionality

Detection Strategies

Monitor for HTTP requests to authentication endpoints (/login/, /accounts/login/, /admin/login/) with abnormally large POST body sizes
Implement request timeout monitoring to detect slow-processing authentication requests
Configure web application firewalls (WAF) to flag requests with excessive Unicode content in form fields
Set up alerting for sustained high CPU usage on Django application servers running on Windows

Monitoring Recommendations

Enable detailed logging for Django authentication views to capture input sizes and processing times
Deploy application performance monitoring (APM) tools to track response times for authentication endpoints
Configure SentinelOne Singularity to monitor for resource exhaustion patterns on protected Windows endpoints
Implement rate limiting on authentication endpoints to reduce the impact of sustained attack attempts

How to Mitigate CVE-2023-46695

Immediate Actions Required

Upgrade Django to patched versions: 3.2.23, 4.1.13, or 4.2.7 or later
Review and limit the maximum length of username input fields at the application level
Implement request timeout configurations to prevent long-running normalization operations
Consider deploying rate limiting on authentication endpoints as an additional defense layer

Patch Information

Django has released security updates that address this vulnerability. Organizations should upgrade to the following versions:

Django 3.2.x users: Upgrade to 3.2.23 or later
Django 4.1.x users: Upgrade to 4.1.13 or later
Django 4.2.x users: Upgrade to 4.2.7 or later

Detailed patch information is available in the Django Security Release Notes and the Django Weblog Security Releases November 2023 announcement.

Workarounds

Implement application-level input validation to restrict the maximum length of username fields before they reach Django's normalization logic
Configure web server or reverse proxy timeouts to terminate long-running requests
Deploy a WAF rule to block requests with excessive Unicode content targeting authentication endpoints
If running on Windows, consider migrating critical Django applications to Linux where the NFKC normalization performance issue is less severe

bash

# Configuration example for nginx rate limiting on authentication endpoints
# Add to nginx.conf or server block

limit_req_zone $binary_remote_addr zone=auth_limit:10m rate=5r/s;

location /accounts/login/ {
    limit_req zone=auth_limit burst=10 nodelay;
    proxy_read_timeout 10s;
    proxy_pass http://django_backend;
}

location /admin/login/ {
    limit_req zone=auth_limit burst=10 nodelay;
    proxy_read_timeout 10s;
    proxy_pass http://django_backend;
}