Django UsernameField NFKC Normalization DoS Vulnerability (CVE-2023-46695)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability ID and Description: - Vulnerability ID: CVE-2023-46695 - Description: A potential denial-of-service vulnerability in UsernameField on Windows. NFKC normalization is slow on Windows, leading to a potential denial-of-service attack on django.contrib.auth.forms.UsernameField for certain inputs (containing large numbers of Unicode characters). 2. Impact: - The vulnerability affects UsernameField on Windows. - Due to slow NFKC normalization, it may lead to a denial-of-service attack. 3. Mitigation: - To prevent this vulnerability, normalization is no longer performed on invalid values exceeding UsernameField.max_length, as they cannot pass validation anyway. 4. Reporter: - Reporter: mprogrammer 5. Severity: - According to Django's security policy, the severity of this issue is "Medium". 6. Disclosure Date: - Disclosure date: November 29, 2023, 10:52 UTC 7. Vulnerability Type: - Weakness: Uncontrolled resource consumption 8. Reward Amount: - Reward amount: $2,540 9. Vulnerability ID: - CVE-2023-46695 10. Reporter Account: - Reporter account: None 11. Reporting Date: - Reporting date: November 20, 2023, 9:21 UTC 12. Exploitation: - Sending a POST request with over 1 million invalid Unicode characters via Burp Suite caused increased response times and even 504 Gateway Timeout errors. 13. Exploitation Example: - An example screenshot of the exploitation is provided, showing detailed request and response information. This information helps understand the nature, scope of impact, and exploitation method of the vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Django UsernameField NFKC Normalization DoS Vulnerability (CVE-2023-46695)