CSRF validation leak

[Jay <jay.shure@…>]

The CSRF validation compares request.COOKIES[settings.CSRF_COOKIE_NAME] and request.POST.get('csrfmiddlewaretoken', ) to see if a request is legal. But unfortunately both two values are provided by the client side, and they are the same. So it is easy for attackers to fake a request that no 403 will be thrown.

The attached project provides one url entry that returns "ok", unless CSRF fails. Following cmds show how to cheat.

# 200
curl http://127.0.0.1:8000

# 200
curl -G -d test=test http://127.0.0.1:8000

# 403
curl -d test=test http://127.0.0.1:8000

# 200
curl -d "test=test;csrfmiddlewaretoken=1" -b csrftoken=1  http://127.0.0.1:8000

[Luke Plant]

This does not result in a CSRF vulnerability. curl is irrelevant - CSRF is about browsers being abused.

[Russell Keith-Magee]

I would also point out that if you even *suspect* that you have found a security issue with Django, *DO NOT* report it in Trac. Mail security@… instead.