Need

Enforce secure and specific Accept headers for HTTP requests

Context

• Usage of Python 3.0 for developing Python applications
• Usage of Django for building web applications in Python

Description

Non compliant code

        from django.http import HttpResponse
from django.views.decorators.csrf import csrf_exempt

@csrf_exempt
def insecure_accept_header(request):
    # Get the 'Accept' header from the request
    accept_header = request.META.get('HTTP_ACCEPT', '*/*')

    # Process the request based on the 'Accept' header
    if accept_header == 'application/json':
        # Process JSON request
        pass
    elif accept_header == 'text/html':
        # Process HTML request
        pass
    else:
        # Process any other type of request
        pass

    return HttpResponse('Request processed.')
        
        

In this Django view, the Accept header is retrieved from the request using request.META.get('HTTP_ACCEPT', '*/*'). This line of code gets the value of the Accept header if it exists, otherwise it defaults to */*, which means that any type of content is accepted.

The problem with this approach is that it allows any MIME type in the requests. If the Accept header is not provided in the request, the application defaults to accepting any type of content. This could potentially allow an attacker to cause unexpected behaviors when the application interprets incorrect content-types.

Moreover, the application does not validate or sanitize the Accept header value before using it to process the request. An attacker could potentially send a request with a malicious Accept header that could lead to security vulnerabilities.

For instance, the application could be tricked into processing a request as JSON when it is actually HTML, or vice versa. This could potentially lead to a range of issues, from functionality problems to security vulnerabilities such as Cross-Site Scripting (XSS) or Content-Type attacks.

Steps

• Validate the 'Accept' header: Instead of accepting any MIME type, validate the 'Accept' header against a whitelist of allowed MIME types.
• Set a default 'Accept' header: If the 'Accept' header is not provided in the request, set a default one instead of accepting any MIME type.
• Handle unexpected 'Accept' headers: If the 'Accept' header is not in the whitelist, return an error response indicating that the MIME type is not supported.

Compliant code

        from django.http import HttpResponse, HttpResponseBadRequest
from django.views.decorators.csrf import csrf_exempt

ALLOWED_MIME_TYPES = ['application/json', 'text/html']

@csrf_exempt
def secure_accept_header(request):
    # Get the 'Accept' header from the request
    accept_header = request.META.get('HTTP_ACCEPT', 'application/json')

    # Validate the 'Accept' header against a whitelist of allowed MIME types
    if accept_header not in ALLOWED_MIME_TYPES:
        return HttpResponseBadRequest('Unsupported MIME type.')

    # Process the request based on the 'Accept' header
    if accept_header == 'application/json':
        # Process JSON request
        pass
    elif accept_header == 'text/html':
        # Process HTML request
        pass

    return HttpResponse('Request processed.')
        
        

The fixed code introduces a few changes to address the vulnerability:

1. Whitelist of Allowed MIME Types: A list of allowed MIME types is defined ( ALLOWED_MIME_TYPES). This list is used to validate the 'Accept' header in the incoming request.

2. Default 'Accept' Header: If the 'Accept' header is not provided in the request, a default one ('application/json') is set. This prevents the application from accepting any MIME type when the 'Accept' header is not provided.

3. Validation of 'Accept' Header: The 'Accept' header in the request is validated against the whitelist of allowed MIME types. If the 'Accept' header is not in the whitelist, an error response ( HttpResponseBadRequest) is returned indicating that the MIME type is not supported.

4. Processing Based on 'Accept' Header: The request is processed based on the 'Accept' header only if it is in the whitelist of allowed MIME types. This ensures that the application behaves as expected for the supported MIME types and prevents unexpected behaviors when incorrect content-types are interpreted.

References

• 153. Insecure or unset HTTP headers - Accept