8 ms·
I don't understand. What is the attack there, and what does Django catch? In my experience with Rails and Phoenix, I'd expect that to just 404. But it looks li
by losvedir 3y ago
I don't understand. What is the attack there, and what does Django catch? In my experience with Rails and Phoenix, I'd expect that to just 404.
But it looks like maybe you're implying the double curly braces allows someone to inject some sort of eval block. Is that a Django thing?
- cwillu 3y agoI _think_ it's an attempt to inject a template for execution via the url, the {{}} being django's template syntax, but…?
- Phemist 3y agoPotentially the path is a Jinja2 template and the product of 41839*41587 evals to a value that makes the whole path a special case? That seems dangerous to allow, AI WAF or not, so I am also not quite sure what the attack here would be.
- xyst 3y agoI don’t use Django but used to write many scripts in Salt. The double curly braces are used by various templating engines to inject variables into static files. The attack here is that an attacker can probably run unsafe code on the server and exfiltrate data or worse. I think by default Django will throw a 404 or 400 like you mentioned. OP would have liked the request to get zapped by the WAF though.
- graemep 3y agoDjango will return a 404 for that in general. The curly braces are evaluated in templates and I am guessing this path will be evaluated as a template (not a standard Django template, but another comment said this would work in Jinja templates). THis seems like a bad idea though.
- slig 3y agoIt doesn't 404 because it's being passed at the `HOST` header, not the path.