Skip to content

Commit 4d334be

Browse files
charettesapollo13
authored and
felixxm
committed
[2.2.x] Fixed CVE-2019-19844 -- Used verified user email for password reset requests.
Backport of 5b1fbce from master. Co-Authored-By: Florian Apolloner <florian@apolloner.eu>
1 parent 86befcc commit 4d334be

4 files changed

Lines changed: 92 additions & 8 deletions

File tree

‎django/contrib/auth/forms.py‎

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,15 @@
2020
UserModel = get_user_model()
2121

2222

23+
def _unicode_ci_compare(s1, s2):
24+
"""
25+
Perform case-insensitive comparison of two identifiers, using the
26+
recommended algorithm from Unicode Technical Report 36, section
27+
2.11.2(B)(2).
28+
"""
29+
return unicodedata.normalize('NFKC', s1).casefold() == unicodedata.normalize('NFKC', s2).casefold()
30+
31+
2332
class ReadOnlyPasswordHashWidget(forms.Widget):
2433
template_name = 'auth/widgets/read_only_password_hash.html'
2534
read_only = True
@@ -256,11 +265,16 @@ def get_users(self, email):
256265
that prevent inactive users and users with unusable passwords from
257266
resetting their password.
258267
"""
268+
email_field_name = UserModel.get_email_field_name()
259269
active_users = UserModel._default_manager.filter(**{
260-
'%s__iexact' % UserModel.get_email_field_name(): email,
270+
'%s__iexact' % email_field_name: email,
261271
'is_active': True,
262272
})
263-
return (u for u in active_users if u.has_usable_password())
273+
return (
274+
u for u in active_users
275+
if u.has_usable_password() and
276+
_unicode_ci_compare(email, getattr(u, email_field_name))
277+
)
264278

265279
def save(self, domain_override=None,
266280
subject_template_name='registration/password_reset_subject.txt',
@@ -273,15 +287,17 @@ def save(self, domain_override=None,
273287
user.
274288
"""
275289
email = self.cleaned_data["email"]
290+
email_field_name = UserModel.get_email_field_name()
276291
for user in self.get_users(email):
277292
if not domain_override:
278293
current_site = get_current_site(request)
279294
site_name = current_site.name
280295
domain = current_site.domain
281296
else:
282297
site_name = domain = domain_override
298+
user_email = getattr(user, email_field_name)
283299
context = {
284-
'email': email,
300+
'email': user_email,
285301
'domain': domain,
286302
'site_name': site_name,
287303
'uid': urlsafe_base64_encode(force_bytes(user.pk)),
@@ -292,7 +308,7 @@ def save(self, domain_override=None,
292308
}
293309
self.send_mail(
294310
subject_template_name, email_template_name, context, from_email,
295-
email, html_email_template_name=html_email_template_name,
311+
user_email, html_email_template_name=html_email_template_name,
296312
)
297313

298314

‎docs/releases/1.11.27.txt‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,25 @@
22
Django 1.11.27 release notes
33
============================
44

5-
*Expected January 2, 2020*
5+
*December 18, 2019*
66

7-
Django 1.11.27 fixes a data loss bug in 1.11.26.
7+
Django 1.11.27 fixes a security issue and a data loss bug in 1.11.26.
8+
9+
CVE-2019-19844: Potential account hijack via password reset form
10+
================================================================
11+
12+
By submitting a suitably crafted email address making use of Unicode
13+
characters, that compared equal to an existing user email when lower-cased for
14+
comparison, an attacker could be sent a password reset token for the matched
15+
account.
16+
17+
In order to avoid this vulnerability, password reset requests now compare the
18+
submitted email using the stricter, recommended algorithm for case-insensitive
19+
comparison of two identifiers from `Unicode Technical Report 36, section
20+
2.11.2(B)(2)`__. Upon a match, the email containing the reset token will be
21+
sent to the email address on record rather than the submitted address.
22+
23+
.. __: https://www.unicode.org/reports/tr36/#Recommendations_General
824

925
Bugfixes
1026
========

‎docs/releases/2.2.9.txt‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,25 @@
22
Django 2.2.9 release notes
33
==========================
44

5-
*Expected January 2, 2020*
5+
*December 18, 2019*
66

7-
Django 2.2.9 fixes a data loss bug in 2.2.8.
7+
Django 2.2.9 fixes a security issue and a data loss bug in 2.2.8.
8+
9+
CVE-2019-19844: Potential account hijack via password reset form
10+
================================================================
11+
12+
By submitting a suitably crafted email address making use of Unicode
13+
characters, that compared equal to an existing user email when lower-cased for
14+
comparison, an attacker could be sent a password reset token for the matched
15+
account.
16+
17+
In order to avoid this vulnerability, password reset requests now compare the
18+
submitted email using the stricter, recommended algorithm for case-insensitive
19+
comparison of two identifiers from `Unicode Technical Report 36, section
20+
2.11.2(B)(2)`__. Upon a match, the email containing the reset token will be
21+
sent to the email address on record rather than the submitted address.
22+
23+
.. __: https://www.unicode.org/reports/tr36/#Recommendations_General
824

925
Bugfixes
1026
========

‎tests/auth_tests/test_forms.py‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -754,6 +754,42 @@ def test_invalid_email(self):
754754
self.assertFalse(form.is_valid())
755755
self.assertEqual(form['email'].errors, [_('Enter a valid email address.')])
756756

757+
def test_user_email_unicode_collision(self):
758+
User.objects.create_user('mike123', 'mike@example.org', 'test123')
759+
User.objects.create_user('mike456', 'mıke@example.org', 'test123')
760+
data = {'email': 'mıke@example.org'}
761+
form = PasswordResetForm(data)
762+
self.assertTrue(form.is_valid())
763+
form.save()
764+
self.assertEqual(len(mail.outbox), 1)
765+
self.assertEqual(mail.outbox[0].to, ['mıke@example.org'])
766+
767+
def test_user_email_domain_unicode_collision(self):
768+
User.objects.create_user('mike123', 'mike@ixample.org', 'test123')
769+
User.objects.create_user('mike456', 'mike@ıxample.org', 'test123')
770+
data = {'email': 'mike@ıxample.org'}
771+
form = PasswordResetForm(data)
772+
self.assertTrue(form.is_valid())
773+
form.save()
774+
self.assertEqual(len(mail.outbox), 1)
775+
self.assertEqual(mail.outbox[0].to, ['mike@ıxample.org'])
776+
777+
def test_user_email_unicode_collision_nonexistent(self):
778+
User.objects.create_user('mike123', 'mike@example.org', 'test123')
779+
data = {'email': 'mıke@example.org'}
780+
form = PasswordResetForm(data)
781+
self.assertTrue(form.is_valid())
782+
form.save()
783+
self.assertEqual(len(mail.outbox), 0)
784+
785+
def test_user_email_domain_unicode_collision_nonexistent(self):
786+
User.objects.create_user('mike123', 'mike@ixample.org', 'test123')
787+
data = {'email': 'mike@ıxample.org'}
788+
form = PasswordResetForm(data)
789+
self.assertTrue(form.is_valid())
790+
form.save()
791+
self.assertEqual(len(mail.outbox), 0)
792+
757793
def test_nonexistent_email(self):
758794
"""
759795
Test nonexistent email address. This should not fail because it would

0 commit comments

Comments
 (0)