CVE-2020-4071: Timing Attack Vulnerability in django-basic-auth-ip-whitelist
Summary
CVE-2020-4071: In django-basic-auth-ip-whitelist before 0.3.4, a potential timing attack exists on websites where the basic authentication is used or configured, i.e. Affects django-basic-auth-ip-whitelist versions < 0.3.4. Fixed in 0.3.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
django-basic-auth-ip-whitelist is a package for Django projects that provides basic authentication with IP address whitelisting. It allows websites to restrict access based on both basic authentication credentials and IP addresses. This package is vulnerable to a timing attack when basic authentication is used or configured. The comparison of user-provided credentials with the configured credentials is performed character-by-character, which can be exploited by an attacker to determine valid credentials.
Vulnerability Detail
The timing attack vulnerability in django-basic-auth-ip-whitelist allows an attacker within the local network to determine valid basic authentication credentials by measuring the time it takes for the server to validate different usernames and passwords. While this attack is not realistic over the Internet, it can be achieved from within a data center or local network where the website is hosted. Websites protected by IP address whitelisting only are not affected by this vulnerability.
How To Fix
Minimum fixed version
0.3.4
This is the first release that contains the fix.
pip install --upgrade "django-basic-auth-ip-whitelist==0.3.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 0.3.4 is not possible, a workaround is to stop using basic authentication and rely solely on IP whitelisting. This can be achieved by not setting the BASIC_AUTH_LOGIN and BASIC_AUTH_PASSWORD in the Django project settings.
Conclusion
The timing attack vulnerability in django-basic-auth-ip-whitelist can be mitigated by upgrading to version 0.3.4 and changing the basic authentication credentials. Alternatively, websites can rely solely on IP whitelisting to avoid this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django-basic-auth-ip-whitelist →
FAQ
The vulnerability allows an attacker within the local network to determine valid basic authentication credentials, potentially leading to unauthorized access to protected resources.
No, this vulnerability is not realistic to exploit over the Internet. It requires the attacker to be within the local network or data center where the website is hosted.
No, websites that rely solely on IP address whitelisting are not affected by this vulnerability.
To fix this vulnerability, update django-basic-auth-ip-whitelist to version 0.3.4 and change the basic authentication credentials configured on your Django project.
Yes, you can stop using basic authentication and rely only on IP whitelisting by not setting the BASIC_AUTH_LOGIN and BASIC_AUTH_PASSWORD in your Django project settings.
