CVE-2019-19844 PoC — Django 授权问题漏洞

Source

https://github.com/ryu22e/django_cve_2019_19844_poc

Associated Vulnerability

Title:Django 授权问题漏洞 (CVE-2019-19844)
Description:Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)

Description

PoC for CVE-2019-19844(https://www.djangoproject.com/weblog/2019/dec/18/security-releases/)

Readme

# django_cve_2019_19844_poc
PoC for [CVE-2019-19844](https://www.djangoproject.com/weblog/2019/dec/18/security-releases/)

![](https://github.com/ryu22e/django_cve_2019_19844_poc/workflows/django_cve_2019_19844_poc/badge.svg)

# Requirements

- Python 3.7.x
- PostgreSQL 9.5 or higher

## Setup

1. Create database(e.g. `django_cve_2019_19844_poc`)
1. Set the database name to the environment variable `DJANGO_DATABASE_NAME`(e.g. `export DJANGO_DATABASE_NAME=django_cve_2019_19844_poc`)
1. Run `pip install -r requirements.txt && ./manage.py migrate --noinput`
1. Create the following user with `shell` command:

```python
>>> from django.contrib.auth import get_user_model
>>> User = get_user_model()
>>> User.objects.create_user('mike123', 'mike@example.org', 'test123')
```

## Procedure For Reproducing

1. Run `./manage.py runserver`
1. Open `http://127.0.0.1:8000/accounts/password-reset/`
1. Input `mıke@example.org` (Attacker's email), and click send button
1. Receive email (Check console), and reset password
1. Login as `mike123` user

![Email](/images/email.jpg "Email")

File Snapshot


 [4.0K]  /data/pocs/afe96e6f285f314c98e751e2cc3ab42167005154
├── [4.0K]  accounts
│   ├── [  63]  admin.py
│   ├── [  91]  apps.py
│   ├── [ 345]  forms.py
│   ├── [   0]  __init__.py
│   ├── [4.0K]  migrations
│   │   └── [   0]  __init__.py
│   ├── [  57]  models.py
│   ├── [4.0K]  templates
│   │   ├── [ 349]  login.html
│   │   ├── [4.0K]  mails
│   │   │   └── [4.0K]  password_reset
│   │   │       ├── [ 155]  body.txt
│   │   │       └── [  15]  subject.txt
│   │   ├── [ 221]  password_reset_complete.html
│   │   ├── [ 265]  password_reset_confirm.html
│   │   ├── [ 164]  password_reset_done.html
│   │   ├── [ 299]  password_reset.html
│   │   └── [ 218]  profile.html
│   ├── [2.5K]  tests.py
│   ├── [1.5K]  urls.py
│   └── [1.0K]  views.py
├── [4.0K]  django_cve_2019_19844_poc
│   ├── [ 427]  asgi.py
│   ├── [   0]  __init__.py
│   ├── [3.8K]  settings.py
│   ├── [ 825]  urls.py
│   └── [ 427]  wsgi.py
├── [4.0K]  images
│   └── [164K]  email.jpg
├── [1.0K]  LICENSE
├── [ 645]  manage.py
├── [1.1K]  README.md
└── [  79]  requirements.txt

7 directories, 27 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!