CVE-2020-35681
📋 TL;DR
CVE-2020-35681 is an information disclosure vulnerability in Django Channels 3.x where the legacy channels.http.AsgiHandler class incorrectly separates request scopes in ASGI environments. This allows attackers to potentially receive responses intended for other clients, leading to leakage of session identifiers and sensitive data. Only applications using Django Channels' legacy HTTP handler class (not Django's native ASGIHandler) are affected.
💻 Affected Systems
- Django Channels
📦 What is this software?
Channels by Djangoproject
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain session tokens, authentication credentials, or other sensitive data from other users, leading to account takeover and data breaches.
Likely Case
Intermittent leakage of session identifiers or user-specific data to unauthorized parties, potentially enabling session hijacking.
If Mitigated
With proper network segmentation and monitoring, impact is limited to potential data exposure within the affected application scope.
🎯 Exploit Status
Exploitation requires precise timing and multiple concurrent requests, making it somewhat difficult but feasible for determined attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.3
Vendor Advisory: https://channels.readthedocs.io/en/stable/releases/3.0.3.html
Restart Required: Yes
Instructions:
1. Update Django Channels to version 3.0.3 or later using pip: 'pip install channels>=3.0.3'. 2. Restart your ASGI server/application. 3. Verify the update with 'pip show channels'.
🔧 Temporary Workarounds
Migrate to Django 3.0+ ASGIHandler
allReplace channels.http.AsgiHandler with Django's native ASGIHandler if using Django 3.0 or later
Disable legacy HTTP handler
allRemove or disable usage of channels.http.AsgiHandler in your ASGI configuration
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected applications
- Deploy web application firewall (WAF) rules to detect and block suspicious request patterns
🔍 How to Verify
Check if Vulnerable:
Check if using Django Channels <3.0.3 with channels.http.AsgiHandler in your ASGI configurationCheck Version:
pip show channels | grep VersionVerify Fix Applied:
Confirm Django Channels version is 3.0.3 or higher and verify channels.http.AsgiHandler is not in use📡 Detection & Monitoring
Log Indicators:
- Unexpected application crashes, mismatched request-response pairs in logs, unusual timing patterns in HTTP requests
Network Indicators:
- Multiple concurrent requests from same source with precise timing, unusual response sizes or content mismatches
SIEM Query:
web_server_logs WHERE (status_code >= 500) AND (request_count > threshold) OR (response_time_variation > threshold)🔗 References
- https://channels.readthedocs.io/en/stable/releases/3.0.3.html
- https://channels.readthedocs.io/en/stable/releases/index.html
- https://github.com/django/channels/releases
- https://channels.readthedocs.io/en/stable/releases/3.0.3.html
- https://channels.readthedocs.io/en/stable/releases/index.html
- https://github.com/django/channels/releases
