CVE-2022-4869 (published 2023-01-05T09:15Z)

A vulnerability was found in Evolution Events Artaxerxes. It has been declared as problematic. This vulnerability affects unknown code of the file arta/common/middleware.py of the component POST Parameter Handler. The manipulation of the argument password leads to information disclosure. The attack can be initiated remotely. The patch is identified as 022111407d34815c16c6eada2de69ca34084dc0d. It is recommended to apply a patch to fix this issue. VDB-217438 is the identifier assigned to this vulnerability.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/evolution-events/Artaxerxes
commit_details: repo_url: https://github.com/evolution-events/Artaxerxes
author: Matthijs Kooijman
author_date: 2022-08-12 14:53:54+02:00
msg: HideSensitiveMiddleware: Hide passwords on middleware errors

It turns out that an exception in middleware (such as a CSRF failure)
can bypass the hiding of sensitive post parameters (e.g. passwords in
the login form).

This adds a middleware that ensures that (unless the view specifies
differently), the 'password' parameter is always hidden from error
output (and for views that *do* specify differently, it is hidden also
before the view is executed).

Part of this (view middleware) could be fixed in Django
https://code.djangoproject.com/ticket/33090, but this new middleware
adds a bit more protection for exceptions before the view is even known.
repository: repo_url: https://github.com/evolution-events/Artaxerxes
repo_name: evolution-events/Artaxerxes
description: Evolution Events information system
repo_language: Python
owner: evolution-events
file_changes: filename: middleware.py
change_type: ModificationType.ADD
diff: @@ -0,0 +1,20 @@
+from django.utils.deprecation import MiddlewareMixin
+
+
+class HideSensitiveMiddleware(MiddlewareMixin):
+    """
+    Hide sensitive post variables.
+
+    Django has a mechanism to hide these on a per-view basis, but this makes sure that the variables listed here are
+    hidden even on errors in middleware (i.e. before the view is ran).
+
+    In part, this is a workaround around https://code.djangoproject.com/ticket/33090, but even with that fixed, this
+    middleware adds a bit extra security for exceptions that are triggered before the view is even known.
+
+    Note that this value is overwritten once a view that has its own sensitive_post_variables specified is ran, but
+    that should be ok, the view should then know better.
+    """
+
+    def __call__(self, request):
+        request.sensitive_post_parameters = ['password']
+        return super().__call__(request)

programming_language: Python
filename: production.py
change_type: ModificationType.MODIFY
diff: @@ -98,3 +98,7 @@ AUTH_PASSWORD_VALIDATORS = [
 # TODO: A day is probably too long already, in Django (the upcoming) 3.1 this can be
 # specified in seconds instead.
 PASSWORD_RESET_TIMEOUT_DAYS = 1
+
+# Add extra protection for passwords, partially to work around https://code.djangoproject.com/ticket/33090 but also to
+# add even a bit more protection. Must be first to maximise coverage.
+MIDDLEWARE.append(0, 'arta.common.middleware.HideSensitiveMiddleware')

programming_language: Python