CVE-2023-46695: Djangoproject Django DoS Vulnerability

CVE-2023-46695 Overview

CVE-2023-46695 is a Denial of Service (DoS) vulnerability discovered in Django, the popular Python web framework. The vulnerability exists in the NFKC normalization process used by django.contrib.auth.forms.UsernameField, which exhibits slow performance on Windows systems. An attacker can exploit this weakness by submitting specially crafted inputs containing a very large number of Unicode characters, causing significant resource exhaustion and service degradation.

Critical Impact

Attackers can cause denial of service conditions on Django applications running on Windows by sending malicious username inputs with excessive Unicode characters, potentially rendering authentication systems unavailable.

Affected Products

• Django 3.2 before 3.2.23
• Django 4.1 before 4.1.13
• Django 4.2 before 4.2.7

Discovery Timeline

• 2023-11-01 - Django releases security patches
• 2023-11-02 - CVE-2023-46695 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-46695

Vulnerability Analysis

This vulnerability stems from the way Django handles Unicode normalization using the NFKC (Normalization Form Compatibility Composition) algorithm within the UsernameField form field. When processing user-supplied input, Django normalizes Unicode characters to ensure consistent representation. However, on Windows systems, the underlying NFKC normalization implementation exhibits significantly slower performance when handling inputs with an exceptionally large number of Unicode characters.

The weakness is classified under CWE-770 (Allocation of Resources Without Limits or Throttling), indicating that the application fails to properly limit resource consumption during the normalization process. This allows attackers to craft inputs that consume disproportionate CPU time and system resources.

Root Cause

The root cause lies in the performance characteristics of NFKC Unicode normalization on Windows platforms. The django.contrib.auth.forms.UsernameField class performs normalization on user-supplied username input without adequate restrictions on the complexity or length of Unicode character sequences. When an attacker submits input containing massive Unicode character sequences, the normalization algorithm consumes excessive computational resources, leading to application slowdown or unresponsiveness.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying Django applications running on Windows servers that expose user registration or login forms
2. Crafting HTTP requests containing username fields with extremely large numbers of Unicode characters
3. Submitting these malicious requests to the target application's authentication endpoints
4. Repeating the requests to amplify the resource exhaustion effect

The vulnerability affects any Django application using the standard UsernameField form field on Windows systems where the authentication forms are publicly accessible.

Detection Methods for CVE-2023-46695

Indicators of Compromise

• Abnormal CPU utilization spikes coinciding with authentication form submissions
• Unusually long HTTP request processing times for login or registration endpoints
• Web server access logs showing POST requests to authentication URLs with extremely large request body sizes
• Application performance degradation isolated to user authentication functionality

Detection Strategies

• Monitor for HTTP requests to authentication endpoints (/login/, /accounts/login/, /admin/login/) with abnormally large POST body sizes
• Implement request timeout monitoring to detect slow-processing authentication requests
• Configure web application firewalls (WAF) to flag requests with excessive Unicode content in form fields
• Set up alerting for sustained high CPU usage on Django application servers running on Windows

Monitoring Recommendations

• Enable detailed logging for Django authentication views to capture input sizes and processing times
• Deploy application performance monitoring (APM) tools to track response times for authentication endpoints
• Configure SentinelOne Singularity to monitor for resource exhaustion patterns on protected Windows endpoints
• Implement rate limiting on authentication endpoints to reduce the impact of sustained attack attempts

How to Mitigate CVE-2023-46695

Immediate Actions Required

• Upgrade Django to patched versions: 3.2.23, 4.1.13, or 4.2.7 or later
• Review and limit the maximum length of username input fields at the application level
• Implement request timeout configurations to prevent long-running normalization operations
• Consider deploying rate limiting on authentication endpoints as an additional defense layer

Patch Information

Django has released security updates that address this vulnerability. Organizations should upgrade to the following versions:

• Django 3.2.x users: Upgrade to 3.2.23 or later
• Django 4.1.x users: Upgrade to 4.1.13 or later
• Django 4.2.x users: Upgrade to 4.2.7 or later

Detailed patch information is available in the Django Security Release Notes and the Django Weblog Security Releases November 2023 announcement.

Workarounds

• Implement application-level input validation to restrict the maximum length of username fields before they reach Django's normalization logic
• Configure web server or reverse proxy timeouts to terminate long-running requests
• Deploy a WAF rule to block requests with excessive Unicode content targeting authentication endpoints
• If running on Windows, consider migrating critical Django applications to Linux where the NFKC normalization performance issue is less severe

# Configuration example for nginx rate limiting on authentication endpoints
# Add to nginx.conf or server block

limit_req_zone $binary_remote_addr zone=auth_limit:10m rate=5r/s;

location /accounts/login/ {
    limit_req zone=auth_limit burst=10 nodelay;
    proxy_read_timeout 10s;
    proxy_pass http://django_backend;
}

location /admin/login/ {
    limit_req zone=auth_limit burst=10 nodelay;
    proxy_read_timeout 10s;
    proxy_pass http://django_backend;
}