591034 - Escaping Needed to Prevent Stored XSS via Django's CSRF Token

Status: VERIFIED FIXED

(Websites :: Other, defect)

Description

[Michael Coates [:mcoates] (acct no longer active)]

Issue

Django's CSRF defense contains a flaw which allows cross site scripting attacks via the CSRF cookie.  This issue is being tracked by django here: http://code.djangoproject.com/ticket/14032. 

This attack could be launched from a subdomain or from a man in the middle attack via cookie forcing. This would allow an attacker to inject a stored XSS attack within the victim's browser. The XSS would fire anytime the victim visits a form using DJANGO's csrf controls within a valid domain for the infected cookie. 


Recommended Resolution

This is a publicly disclosed XSS vulnerability and will need to be resolved on our end as soon as possible. The recommended solution is to modify all uses of django's CSRF defense and remove the "safe" flag. This will ensure that DJANGO safely displays the CSRF token within the HTTP response.  

Note: The attacker does not need access to the django components in order to launch this attack. Once the victim's cookie is infected the attack will launch whenever the victim access the page. Therefore, restricted pages, such as those protected by LDAP auth, or equally vulnerable to attack.

Comment 1

[Alex Buchanan [:abuchanan]]

Fixed in 
http://github.com/abuchanan/basket/commit/a6b96d02340388e903910369a4a5dcb26aa7cbdd
http://github.com/abuchanan/basket/commit/713e3970c58934919cc8faf67a09ddfd0a98408a

IT production update bug 594573

Comment 2

[Alex Buchanan [:abuchanan]]

Was pushed, but bugs were never closed

Comment 3

[Michael Coates [:mcoates] (acct no longer active)]

Verified in prod.

Comment 4

[Yvan Boily [:ygjb][:yvan]]

Adding keywords to bugs for metrics, no action required.  Sorry about bugmail spam.