django-tastypie Cache Throttle Race Condition Vulnerability

A race condition vulnerability has been identified in django-tastypie versions through 0.15.1. The issue arises in the CacheThrottle and CacheDBThrottle functions within tastypie/throttle.py. This vulnerability can be exploited remotely, although the complexity of the attack is considered high.

Impact

Exploitation of this vulnerability allows concurrent requests to bypass the caching throttle limits, potentially leading to excessive API usage.

Reproduction

To reproduce this vulnerability, use an application that employs django-tastypie for API management and has `CacheThrottle` or `CacheDBThrottle` configured. Send multiple concurrent requests to an API endpoint that is throttled. The requests can be made through a tool that supports parallel processing, such as a custom script or an API testing tool that allows for concurrent requests. Monitor the API response to verify that the throttle limits have been exceeded.

Remediation

It is recommended to implement throttle accounting with atomic cache or backend operations. For example, use Redis atomic counters, compare-and-set operations, Lua scripts, or a per-identifier lock around the check and record processes.