GHSA-3c93-f73f-qc9h: High severity pip/social-auth-core vulnerability
Impact
The vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted.
Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as viewerid, accesstoken, apiid, and apiresult, potentially allowing authentication as an arbitrary VK user ID.
The issue affects only applications using the vk-app backend.
Patches
The issue has been fixed by requiring authkey to be present and valid before callback data is trusted.
Users should upgrade to a patched version.
Fix:
https://github.com/python-social-auth/social-core/pull/1811
Workarounds
Applications that cannot upgrade immediately should disable the vk-app backend by removing socialcore.backends.vk.VKAppOAuth2 from SOCIALAUTHAUTHENTICATIONBACKENDS.
There is no complete workaround while continuing to use the vulnerable backend.
Credits
Reported by @lalalala5678 through GitHub private vulnerability reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/social-auth-coreto a version that resolves this vulnerability.Fixed in 5.0.0 - Configuration
Disable the vk-app backend by removing social_core.backends.vk.VKAppOAuth2 from SOCIAL_AUTH_AUTHENTICATION_BACKENDS.
python-social-auth social-core SOCIAL_AUTH_AUTHENTICATION_BACKENDS = Remove social_core.backends.vk.VKAppOAuth2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only applications that use the vk-app backend are affected. Applications using other backends are not identified as affected by the provided advisory.
What does an attacker need to exploit the vulnerability?
An attacker can send callback data with the auth_key parameter omitted. They can control fields including viewer_id, access_token, api_id, and api_result, which may allow authentication as an arbitrary VK user ID.
Are unsigned callbacks accepted in the vulnerable configuration?
Yes. The vulnerable vk-app backend accepted callback data without verifying its signature when auth_key was absent, treating attacker-controlled unsigned data as a verified VK identity.
What should be done if upgrading is not immediately possible?
Disable the vk-app backend by removing social_core.backends.vk.VKAppOAuth2 from SOCIAL_AUTH_AUTHENTICATION_BACKENDS. The advisory states that there is no complete workaround if the vulnerable backend remains enabled.