Overview
CVE-2007-0405 describes an Improper Inventory Management issue in Django 0.95 where the LazyUser class used by AuthenticationMiddleware cached the authenticated username across requests. This effectively caused per-request identity information to be treated as if it were the same across multiple requests, enabling a remote authenticated user to leverage the privileges of another user. The patch for this vulnerability corrected how per-request identity is handled and removed cross-request caching. In real-world deployments, such a flaw can enable privilege escalation, data access beyond a user's permissions, or manipulation of resources by impersonating another account.
The vulnerability manifested when a server process cached the user identity in a class-level or global structure, so subsequent requests could reuse that cached identity instead of using the current request's authenticated user. An attacker who established an authenticated session could exploit the cached identity to perform actions with another user's privileges, assuming the rest of the access checks did not independently validate the per-request user. This is a classic Improper Inventory Management pattern where the system makes incorrect assumptions about the freshness or isolation of identity data across requests.
To fix this pattern in Django, you must ensure that user identity is evaluated per-request and never reused across requests unless the cache is strictly scoped to the request lifecycle. Avoid any module-, class-, or process-wide caches for user data. Rely on Django's per-request AuthenticationMiddleware flow, and upgrade to patched Django versions where the bug is addressed. The remediation also includes adding tests that verify per-request isolation of user identity and reviewing any custom middleware that might introduce cross-request caching of user data.
Remediation guidance references CVE-2007-0405 and the related fix in Django; follow the code patterns below to replace the vulnerable approach with per-request evaluation and proper isolation.
Affected Versions
Django 0.95 (and earlier)
Code Fix Example
Django API Security Remediation
Vulnerable pattern:
class LazyUser(object):
_cached_username = None # class-level cache across requests (bug)
def __init__(self, get_user_fn):
self.get_user_fn = get_user_fn
@property
def username(self):
if LazyUser._cached_username is None:
# Caches username across requests; can be exploited for impersonation
LazyUser._cached_username = self.get_user_fn().username
return LazyUser._cached_username
def handle_request(request):
lazy = LazyUser(lambda: request.user)
# Use lazy.username for authorization decisions
return lazy.username
# Patch / Fix:
class SafeUser(object):
def __init__(self, get_user_fn):
self.get_user_fn = get_user_fn
@property
def username(self):
# Per-request evaluation; no cross-request caching
return self.get_user_fn().username
def handle_request_fixed(request):
lazy = SafeUser(lambda: request.user)
return lazy.username