diff options
Diffstat (limited to 'docs/topics/http')
| -rw-r--r-- | docs/topics/http/sessions.txt | 29 |
1 files changed, 16 insertions, 13 deletions
diff --git a/docs/topics/http/sessions.txt b/docs/topics/http/sessions.txt index 20502208a8..2f9f29b84b 100644 --- a/docs/topics/http/sessions.txt +++ b/docs/topics/http/sessions.txt @@ -123,13 +123,15 @@ and the :setting:`SECRET_KEY` setting. .. warning:: - **If the SECRET_KEY is not kept secret and you are using the** - ``django.contrib.sessions.serializers.PickleSerializer``, **this can - lead to arbitrary remote code execution.** + **If the ``SECRET_KEY`` or ``SECRET_KEY_FALLBACKS`` are not kept secret and + you are using the** + ``django.contrib.sessions.serializers.PickleSerializer``, **this can lead + to arbitrary remote code execution.** - An attacker in possession of the :setting:`SECRET_KEY` can not only - generate falsified session data, which your site will trust, but also - remotely execute arbitrary code, as the data is serialized using pickle. + An attacker in possession of the :setting:`SECRET_KEY` or + :setting:`SECRET_KEY_FALLBACKS` can not only generate falsified session + data, which your site will trust, but also remotely execute arbitrary code, + as the data is serialized using pickle. If you use cookie-based sessions, pay extra care that your secret key is always kept completely secret, for any system which might be remotely @@ -323,11 +325,12 @@ cookie backend*. For example, here's an attack scenario if you use :mod:`pickle` to serialize session data. If you're using the :ref:`signed cookie session backend -<cookie-session-backend>` and :setting:`SECRET_KEY` is known by an attacker -(there isn't an inherent vulnerability in Django that would cause it to leak), -the attacker could insert a string into their session which, when unpickled, -executes arbitrary code on the server. The technique for doing so is simple and -easily available on the internet. Although the cookie session storage signs the +<cookie-session-backend>` and :setting:`SECRET_KEY` (or any key of +:setting:`SECRET_KEY_FALLBACKS`) is known by an attacker (there isn't an +inherent vulnerability in Django that would cause it to leak), the attacker +could insert a string into their session which, when unpickled, executes +arbitrary code on the server. The technique for doing so is simple and easily +available on the internet. Although the cookie session storage signs the cookie-stored data to prevent tampering, a :setting:`SECRET_KEY` leak immediately escalates to a remote code execution vulnerability. @@ -359,8 +362,8 @@ Bundled serializers .. class:: serializers.PickleSerializer Supports arbitrary Python objects, but, as described above, can lead to a - remote code execution vulnerability if :setting:`SECRET_KEY` becomes known - by an attacker. + remote code execution vulnerability if :setting:`SECRET_KEY` or any key of + :setting:`SECRET_KEY_FALLBACKS` becomes known by an attacker. .. deprecated:: 4.1 |