CVE-2023-46695: Potential denial of service vulnerability in UsernameField on Windows

Disclosed: 2023-11-29 22:52:52 By mprogrammer To ibb
Medium
Vulnerability Details
In Django versions before 4.2.7, 4.1.13, and 3.2.23, I sent a POST request to the admin login page using Burp Suite, editing the request to send over 1 million invalid unicode characters to my local web server running Django. (I used: "¾") After submitting, a single request took 4.4 seconds on average. When I sent 20 concurrent requests, then I got 60 second wait times, and 504 gateway timeout errors on my machine. {F2871465} Normal ascii characters don't do this and the page loads instantly. ## Impact Denial of Service anywhere a form contains a UsernameField that checks for errors.
Actions
View on HackerOne
Report Stats
  • Report ID: 2258758
  • State: Closed
  • Substate: resolved
  • Upvotes: 27
Share this report