CVE-2020-4071: Timing attack on django-basic-auth-ip-whitelist
Summary
CVE-2020-4071: Timing attack on django-basic-auth-ip-whitelist. Affects django-basic-auth-ip-whitelist versions < 0.3.4. Fixed in 0.3.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
django-basic-auth-ip-whitelist is a package for Django projects that provides basic authentication and IP address whitelisting functionalities. It allows websites to protect their content by requiring users to provide valid credentials or access the site only from whitelisted IP addresses. However, a vulnerability has been discovered in versions prior to 0.3.4 that could potentially be exploited through a timing attack.
Vulnerability Detail
The vulnerability arises from the character-by-character string comparison used to validate user credentials in basic authentication. By measuring the time it takes for the server to validate different usernames and passwords, an attacker within the local network could potentially deduce the valid credentials. This attack is not considered realistic over the Internet, but it could be feasible within a data center where the website's server is located. Websites protected solely by IP address whitelisting are not affected by this vulnerability.
How To Fix
Minimum fixed version
0.3.4
This is the first release that contains the fix.
pip install --upgrade "django-basic-auth-ip-whitelist==0.3.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If basic authentication is not necessary, an alternative workaround is to solely rely on the IP whitelisting component of django-basic-auth-ip-whitelist. This can be achieved by not setting the BASIC_AUTH_LOGIN and BASIC_AUTH_PASSWORD in the Django project settings.
Conclusion
In conclusion, the timing attack vulnerability in django-basic-auth-ip-whitelist can potentially be exploited by an attacker within the local network. It is important to update to version 0.3.4 and change the basic authentication credentials to mitigate this risk. Websites solely relying on IP address whitelisting are not affected. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for django-basic-auth-ip-whitelist →
FAQ
The vulnerability allows an attacker within the local network to potentially deduce valid credentials by measuring the time it takes for the server to validate different usernames and passwords. However, this attack is not considered realistic over the Internet.
No, websites that solely rely on IP address whitelisting are not affected by this vulnerability.
The recommended fix is to update to version 0.3.4 of django-basic-auth-ip-whitelist and change the basic authentication username and password configured on any Django project using this package.
Yes, if basic authentication is not necessary, websites can solely rely on the IP whitelisting component of django-basic-auth-ip-whitelist by not setting the BASIC_AUTH_LOGIN and BASIC_AUTH_PASSWORD in the Django project settings.
For more information, you can refer to the Django mailing list discussion linked in the references section of the vulnerability details.
