CVE-2022-4869: Insufficient Information (NVD-CWE-noinfo)
value: A vulnerability was found in Evolution Events Artaxerxes. It has been declared as problematic. This vulnerability affects unknown code of the file arta/common/middleware.py of the component POST Parameter Handler. The manipulation of the argument password leads to information disclosure. The attack can be initiated remotely. The patch is identified as 022111407d34815c16c6eada2de69ca34084dc0d. It is recommended to apply a patch to fix this issue. VDB-217438 is the identifier assigned to this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2023-01-05T09:15Z
Repository: https://github.com/evolution-events/Artaxerxes
Language: Python
Files changed: arta/common/middleware.py, arta/settings/production.py
Commit date: 2022-08-12 14:53:54 +0200
Commit message: HideSensitiveMiddleware: Hide passwords on middleware errors

It turns out that an exception in middleware (such as a CSRF failure)
can bypass the hiding of sensitive post parameters (e.g. passwords in
the login form).

This adds a middleware that ensures that (unless the view specifies
differently), the 'password' parameter is always hidden from error
output (and for views that *do* specify differently, it is hidden also
before the view is executed).

Part of this (view middleware) could be fixed in Django
https://code.djangoproject.com/ticket/33090, but this new middleware
adds a bit more protection for exceptions before the view is even known.

Diff: diff --git a/arta/common/middleware.py b/arta/common/middleware.py
new file mode 100644
index 0000000..86954b4
--- /dev/null
+++ b/arta/common/middleware.py
@@ -0,0 +1,20 @@
+from django.utils.deprecation import MiddlewareMixin
+
+
+class HideSensitiveMiddleware(MiddlewareMixin):
+    """
+    Hide sensitive post variables.
+
+    Django has a mechanism to hide these on a per-view basis, but this makes sure that the variables listed here are
+    hidden even on errors in middleware (i.e. before the view is ran).
+
+    In part, this is a workaround around https://code.djangoproject.com/ticket/33090, but even with that fixed, this
+    middleware adds a bit extra security for exceptions that are triggered before the view is even known.
+
+    Note that this value is overwritten once a view that has its own sensitive_post_variables specified is ran, but
+    that should be ok, the view should then know better.
+    """
+
+    def __call__(self, request):
+        request.sensitive_post_parameters = ['password']
+        return super().__call__(request)
diff --git a/arta/settings/production.py b/arta/settings/production.py
index b22df74..4601122 100644
--- a/arta/settings/production.py
+++ b/arta/settings/production.py
@@ -96,5 +96,9 @@ AUTH_PASSWORD_VALIDATORS = [
 
 # How long a password reset link should work.
 # TODO: A day is probably too long already, in Django (the upcoming) 3.1 this can be
 # specified in seconds instead.
 PASSWORD_RESET_TIMEOUT_DAYS = 1
+
+# Add extra protection for passwords, partially to work around https://code.djangoproject.com/ticket/33090 but also to
+# add even a bit more protection. Must be first to maximise coverage.
+MIDDLEWARE.append(0, 'arta.common.middleware.HideSensitiveMiddleware')

Fixed code: from django.utils.deprecation import MiddlewareMixin


class HideSensitiveMiddleware(MiddlewareMixin):
    """
    Hide sensitive post variables.

    Django has a mechanism to hide these on a per-view basis, but this makes sure that the variables listed here are
    hidden even on errors in middleware (i.e. before the view is ran).

    In part, this is a workaround around https://code.djangoproject.com/ticket/33090, but even with that fixed, this
    middleware adds a bit extra security for exceptions that are triggered before the view is even known.

    Note that this value is overwritten once a view that has its own sensitive_post_variables specified is ran, but
    that should be ok, the view should then know better.
    """

    def __call__(self, request):
        request.sensitive_post_parameters = ['password']
        return super().__call__(request)

# Add extra protection for passwords, partially to work around https://code.djangoproject.com/ticket/33090 but also to
# add even a bit more protection. Must be first to maximise coverage.
MIDDLEWARE.append(0, 'arta.common.middleware.HideSensitiveMiddleware')