CVE-2023-41885: Piccolo ORM BaseUser.login Information Leakage
Summary
CVE-2023-41885: Piccolo is an ORM and query builder which supports asyncio. Affects piccolo across 2 version ranges.
< 0.121.0
< edcfe3568382922ba3e3b65896e6e7272f972261
Fixed in edcfe3568382922ba3e3b65896e6e7272f972261. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Piccolo is an ORM and query builder that supports asyncio. It provides functionality for managing database records and executing queries. The BaseUser.login function is responsible for user authentication and login. Piccolo versions 0.120.0 and prior are affected by a vulnerability that leaks information, allowing a malicious user to generate a list of valid users on the platform. As Piccolo does not enforce strong passwords, this list can be used in password spray attacks to attempt takeover of user accounts. The impact of this vulnerability is minor as it requires additional attack vectors to gain more than just a list of valid users. The likelihood of exploitation is possible, as the underlying login functionality for Piccolo-based sites is open source. This issue has been patched in version 0.121.0.
Vulnerability Detail
The vulnerability in Piccolo ORM versions 0.120.0 and prior lies in the implementation of the BaseUser.login function. It allows a malicious user to gather enough information to generate a list of valid users on the platform. This information leakage can be used in password spray attacks to attempt unauthorized access to user accounts. The vulnerability is considered minor as it requires chaining with other attack vectors to achieve more than just obtaining a list of valid users. The likelihood of exploitation is possible, especially considering the open-source nature of the login functionality in Piccolo-based sites. The vulnerability has a CVSS score of 5.3.
How To Fix
Minimum fixed version
edcfe3568382922ba3e3b65896e6e7272f972261
This is the first release that contains the fix.
pip install --upgrade "piccolo==edcfe3568382922ba3e3b65896e6e7272f972261"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The information leakage vulnerability in Piccolo ORM versions 0.120.0 and prior can allow a malicious user to generate a list of valid users on the platform. Although the impact is minor, it can be used in conjunction with other attack vectors to attempt unauthorized access to user accounts. It is important to update to Piccolo version 0.121.0 or later to mitigate this vulnerability. Additionally, enforcing strong password policies for user accounts is recommended. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for piccolo →
FAQ
The impact of this vulnerability is minor as it only allows a malicious user to obtain a list of valid users on the platform. However, it can be used in conjunction with other attack vectors to attempt unauthorized access to user accounts.
No, Piccolo does not enforce strong passwords. This means that even if a list of valid users is obtained, the accounts may have weak passwords, making them more susceptible to password spray attacks.
The likelihood of exploitation is possible as the underlying login functionality for Piccolo-based sites is open source. This makes it easier for malicious users to analyze and exploit the information leakage vulnerability.
Yes, the vulnerability has been patched in Piccolo version 0.121.0. It is recommended to update to this version or later to mitigate the information leakage issue.
While updating to the latest version is crucial, it is also recommended to enforce strong password policies for user accounts. This will help mitigate the risk of password spray attacks even if a list of valid users is obtained.
References
Related vulnerabilities
Recent vulnerabilities recorded for piccolo.
