Session takeover vulnerability/bug Found on python.org

[Yadnyawalkya]

Hi there, I noticed session takeover vulnerability on python.org.
Details are as follows :

Browser I Used

1. Mozilla Firefox v48
2. Google Chromium v51

Operating System Used
Windows 8.1 also checked Edubuntu 14.04

Login Required
Yes

Vulnerable Link
https://www.python.org

Description
Sessions of users accounts not terminated after been password changed

Steps to reproduce issue
(You have to use two browsers here. You can use Incognito mode)

1. Register an account on https://www.python.org with a valid information.
2. Logged into your account with first browser
3. On second browser, Login on same account and Change/Reset password.
4. Now goto first browser and refresh the link i.e. https://www.python.org. You will notice that sessions are still alive and not terminated.

Possible Impact Scenario
Suppose Victim Logged into his account at internet cafe and forgot to Logout.
Suppose You are attacker and you found victims account is open on same PC. Now attacker can download 'EditThisCookie 1.4.1' Chrome extension and export/copy cookie of victims acc in text file.
Now victim get to know that someone is using his acc and he just change password.
But attacker have victims account's cookies so he can just import that cookie with 'EditThisCookie 1.4.1' and use victims account anytime because all sessions are not get terminating after password change. This may leads to miss-use of victims details and account .

Expected
All live sessions must terminate after password changed.

[berkerpeksag]

I think Django already does this, but we don't use built-in authentication tools. django-allauth may not destroy session data at logout or profile update. I will do further investigation.

Thanks for the report!

[berkerpeksag]

I think 76a461f should resolve this. @YadnyawalkyaTale could you please try again https://staging.python.org/ in an hour (it should be deployed automatically to the staging site.)

I'd like add your name to https://github.com/python/pythondotorg/blob/master/templates/humans.txt Feel free send a pull request or I can add it myself.

[Yadnyawalkya]

Just checked issue, It is no-more reproducible ! Great fix btw ;)

You can add blog link http://yadnyawalkya.blogspot.in with my name Yadnyawalkya Tale to human.txt. Please add pull request from your end.

Sorry for replying after day, I had forgotten about this issue.
Thanks again ! Have a great weekend :)

[berkerpeksag]

Done in 1bb0213, thanks!