PT-2020-14188 · Django · Django Two-Factor Authentication

Benweissmann + 2 · Published 2020-07-10 · Updated 2020-07-21 · CVE-2020-15105

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django Two-Factor Authentication versions prior to 1.12

Description The issue allows the storage of a user's password in clear text in the user session, which can be base64-encoded. This occurs when a user submits their username and password and is removed upon completion of two-factor authentication. The severity of this issue depends on the configured session storage type, with the worst case being database session storage where passwords are stored in clear text in the database, and the best case being signed cookie session storage where passwords are only stored in clear text within the browser's cookie store. In the common case of using cache session storage, passwords are stored in clear text in the configured cache storage, typically Memcached or Redis. After upgrading to a fixed version, users should delete any stored clear text passwords, such as session records from the database, and purge this data from backups or replicas. Affected organizations that have suffered a database breach should inform users that their clear text passwords have been compromised, and all organizations should encourage users to change insecurely stored passwords on any sites where they were used.

Recommendations For versions prior to 1.12, upgrade to version 1.12 to resolve the issue. After upgrading, delete any clear text passwords that have been stored, such as session records from the database, and purge this data from database backups or replicas. As a temporary workaround, consider switching Django's session storage to use signed cookies instead of the database or cache, but this should not be done without a thorough understanding of the security tradeoffs of using signed cookies rather than server-side session storage.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2020-15105

GHSA-VHR6-PVJM-9QWF

PYSEC-2020-39

Affected Products

Django Two-Factor Authentication

References · 9

• https://github.com/Bouke/django-two-factor-auth/commit/454fd9842fa6e8bb772dbf0943976bc8e3335359 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15105 · Security Note
• https://osv.dev/vulnerability/GHSA-vhr6-pvjm-9qwf · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-39 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15105 · Vendor Advisory
• https://github.com/Bouke/django-two-factor-auth/security/advisories/GHSA-vhr6-pvjm-9qwf · Note
• https://github.com/Bouke/django-two-factor-auth/blob/master/CHANGELOG.md#112---2020-07-08 · Note
• https://github.com/Bouke/django-two-factor-auth · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/django-two-factor-auth/PYSEC-2020-39.yaml · Note