CVE-2022-24857: django-mfa3 - Bypass of Multi-Factor Authentication in Django Admin Login
Summary
CVE-2022-24857: django-mfa3 is a library that implements multi factor authentication for the django web framework. Affects django-mfa3 across 2 version ranges.
< 0.5.0
< 32f656e22df120b84bdf010e014bb19bd97971de
Fixed in 32f656e22df120b84bdf010e014bb19bd97971de. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
django-mfa3 is a library that provides multi-factor authentication (MFA) for the Django web framework. It modifies the regular login view to implement MFA. However, the library does not modify the second login view used by Django's admin area. This vulnerability allows bypassing of MFA for users who have activated both django-mfa3 (< 0.5.0) and django.contrib.admin without additional security measures. The issue has been fixed in django-mfa3 0.5.0.
Vulnerability Detail
The vulnerability arises from the lack of modification to the admin login view in django-mfa3. As a result, users who have enabled both django-mfa3 and django.contrib.admin can bypass MFA and gain unauthorized access to the admin login view. This can lead to unauthorized administrative actions and compromise the security of the application.
How To Fix
Minimum fixed version
32f656e22df120b84bdf010e014bb19bd97971de
This is the first release that contains the fix.
pip install --upgrade "django-mfa3==32f656e22df120b84bdf010e014bb19bd97971de"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading django-mfa3 is not immediately possible, a workaround can be implemented by overwriting the admin login route. This can be achieved by adding the following URL definition before the admin routes in the Django project's URL configuration:
from django.conf import settings
from django.shortcuts import redirect
from django.urls import url
urlpatterns = [
url(r'^admin/login/$', lambda request: redirect(settings.LOGIN_URL)),
...
]
Conclusion
The CVE-2022-24857 vulnerability in django-mfa3 allows bypassing of multi-factor authentication for the Django admin login. Users who have enabled both django-mfa3 and django.contrib.admin without additional security measures are affected. To fix the vulnerability, upgrade django-mfa3 to version 0.5.0 or later. If immediate upgrade is not possible, a workaround can be implemented by overwriting the admin login route. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django-mfa3 →
FAQ
You can use Vulert's vulnerability monitoring service to check if your application is affected by this vulnerability. Vulert analyzes your Pipfile.lock and provides real-time alerts for open-source vulnerabilities.
The vulnerability allows bypassing of multi-factor authentication for the Django admin login. This can lead to unauthorized access to the admin area and potential compromise of the application's security.
Yes, the vulnerability has been fixed in django-mfa3 version 0.5.0. Upgrading to this version will address the issue.
Yes, if immediate upgrade is not possible, you can implement a workaround by overwriting the admin login route in the Django project's URL configuration. Details of the workaround are provided in the 'workaround' section above.
You can find more information about this vulnerability in the advisory database of the Python Package Index (PyPI). The source link is provided in the vulnerability details.
