GHSA-526j-582w-7fm9: CSRF
Impact
Applications using the LINE Login backend are vulnerable to login CSRF / forced authentication. An attacker can start a LINE authorization flow for an account they control and trick a victim into visiting the callback URL with the attacker’s authorization code. Because the LINE backend did not validate the returned OAuth state, the application could accept the forged callback and log the victim in as the attacker-controlled LINE account.
If account linking is enabled, the same flaw can allow an attacker to link their LINE identity to a victim’s existing authenticated account, creating a persistent unauthorized login path.
Patches https://github.com/python-social-auth/social-core/pull/1829
Workarounds Only applications that enable the LINE backend are affected.
Credits
Thanks to Ta Duc Thien and Duc Anh Nguyen for reproting this via GitHub.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/social-auth-coreto a version that resolves this vulnerability.Fixed in 5.0.2
Event History
Frequently Asked Questions
Which deployments are affected?
Only applications that enable the LINE Login backend are affected. Applications not using that backend are not affected by this issue.
What does an attacker need to exploit the flaw?
An attacker needs to initiate a LINE authorization flow for a LINE account they control and persuade a victim to visit the resulting callback URL containing the attacker’s authorization code. The victim must interact with that URL.
What is the impact when account linking is enabled?
An attacker may link their own LINE identity to a victim’s already authenticated account. This can create a persistent unauthorized path to log in to that account.
What remediation is identified?
The advisory identifies a patch in the referenced social-core pull request and commit. The defect is the lack of validation of the OAuth state returned by LINE, so the fix addresses forged callback acceptance.