Executive Summary

This vulnerability exists in Django's method `django.http.HttpRequest.get_signed_cookie()`. The issue arises because the salt used for signing cookies is derived by simply concatenating the cookie name and the salt argument. This non-injective salt derivation means that different pairs of cookie names and salts can produce the same concatenated value.

As a result, a remote attacker can exploit this to use a cookie in a different context than the one where it was originally signed, by finding distinct (name, salt) pairs that collide. This can lead to cookies being accepted in unintended contexts.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that an attacker could reuse a signed cookie in a different context than intended, potentially bypassing some security checks that rely on cookie signing.

However, the severity of this issue is classified as low, indicating that while it may allow some misuse of cookies, it is unlikely to lead to severe compromise such as full account takeover or data breach by itself.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Django to a fixed version where the issue has been resolved.

• Upgrade Django 6.0 to version 6.0.6 or later.
• Upgrade Django 5.2 to version 5.2.15 or later.

Note that older unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x may also be affected and should be evaluated accordingly.

The vulnerability has been fixed by implementing an unambiguous salt derivation method in the get_signed_cookie function.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0