Collected research
Disclosing information with a side-channel in Django
Django's dictsort template filter resolved a user-supplied sort key through the full variable-lookup machinery, so an attacker could sort a list of users by an individual character of a field never shown, such as a password hash. Comparing orderings across requests turns the sort into an oracle extracting every user's hash in requests linear in hash length.
Record
- Researcher
- Dennis Brinkrolf
- Published by
- Sonar
- Date
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Dennis Brinkrolf, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .