CVE-2020-11037: Potential Observable Timing Discrepancy in Wagtail
Impact A potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is performed through a character-by-character string comparison, and so an attacker who is able to measure the time taken by this check to a high degree of accuracy could potentially use timing differences to gain knowledge of the password. (This is understood to be feasible on a local network, but not on the public internet.)
Privacy settings that restrict access to pages / documents on a per-user or per-group basis (as opposed to a shared password) are unaffected by this vulnerability.
Patches Patched versions have been released as Wagtail 2.7.3 (for the LTS 2.7 branch), Wagtail 2.8.2 and Wagtail 2.9.
Workarounds Site owners who are unable to upgrade to the new versions can use user- or group-based privacy restrictions to restrict access to sensitive information; these are unaffected by this vulnerability.
Other sources
In Wagtail before versions 2.7.2 and 2.8.2, a potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is performed through a character-by-character string comparison, and so an attacker who is able to measure the time taken by this check to a high degree of accuracy could potentially use timing differences to gain knowledge of the password. This is understood to be feasible on a local network, but not on the public internet. Privacy settings that restrict access to pages/documents on a per-user or per-group basis (as opposed to a shared password) are unaffected by this vulnerability. This has been patched in 2.7.3, 2.8.2, 2.9.
In Wagtail before versions 2.7.3 and 2.8.2, a potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is performed through a character-by-character string comparison, and so an attacker who is able to measure the time taken by this check to a high degree of accuracy could potentially use timing differences to gain knowledge of the password. This is understood to be feasible on a local network, but not on the public internet.
Privacy settings that restrict access to pages/documents on a per-user or per-group basis (as opposed to a shared password) are unaffected by this vulnerability.
This has been patched in 2.7.3, 2.8.2, 2.9.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-11037?
CVE-2020-11037 is a vulnerability in Wagtail before versions 2.7.2 and 2.8.2 that allows for a potential timing attack on pages or documents protected with a shared password.
How does the timing attack in CVE-2020-11037 work?
The timing attack in CVE-2020-11037 works by exploiting the character-by-character string comparison used by Wagtail's 'Privacy' controls for password checking.
What is the severity of CVE-2020-11037?
The severity of CVE-2020-11037 is medium with a severity value of 4.7.
What software versions are affected by CVE-2020-11037?
CVE-2020-11037 affects Wagtail versions between 2.7 and 2.7.3, as well as versions between 2.8 and 2.8.2.
How can I fix CVE-2020-11037?
To fix CVE-2020-11037, it is recommended to upgrade Wagtail to versions 2.7.2 or 2.8.2.