GHSA-fp7w-m676-w7gc: Medium severity pip/social-auth-core vulnerability
Impact
The Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID.
When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop.
The issue affects applications using the Vend OAuth2 backend with more than one Vend shop.
Patches
The issue has been fixed by scoping Vend social-auth UIDs by shop.
Users should upgrade to a patched version.
Fix:
https://github.com/python-social-auth/social-core/pull/1795
Workarounds
Applications that cannot upgrade immediately should restrict the Vend OAuth2 backend to a single trusted Vend shop.
If Vend authentication is not required, the Vend backend can also be disabled by removing it from SOCIALAUTHAUTHENTICATIONBACKENDS.
There is no complete workaround while continuing to allow authentication from multiple Vend shops with the vulnerable backend.
Credits
Reported through GitHub private vulnerability reporting by Liyi Zhou, Ziyue Wang, Strick, Maurice, and Chenchen Yu from the University of Sydney security research team.
Reporter references:
https://lzhou1110.github.io/ https://zyy0530.github.io/ https://str1ckl4nd.github.io/ https://maurice.busystar.org/ https://7thparkk.github.io/
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/social-auth-coreto a version that resolves this vulnerability.Fixed in 5.0.0 - Configuration
Restrict the Vend OAuth2 backend to authentication from a single trusted Vend shop.
Vend OAuth2 backend allowed Vend shops = single trusted Vend shop - Configuration
If Vend authentication is not required, disable the Vend backend by removing it from SOCIAL_AUTH_AUTHENTICATION_BACKENDS.
social-auth SOCIAL_AUTH_AUTHENTICATION_BACKENDS = Vend backend removed
Event History
Frequently Asked Questions
Which deployments are exposed to cross-shop account confusion?
Applications using the Vend OAuth2 backend and allowing authentication from more than one Vend shop are affected. The collision occurs when users in different shops have the same numeric Vend user ID.
What must an attacker have or do to exploit this issue?
The attacker must authenticate through a different Vend shop that is accepted by the same application and have a numeric Vend user ID matching one already associated with a local account from another shop. Exploitation relies on the vulnerable backend treating that numeric ID as globally unique.
What can be done if an upgrade is not immediately possible?
Restrict the Vend OAuth2 backend to one trusted Vend shop, or disable Vend authentication by removing the backend from SOCIAL_AUTH_AUTHENTICATION_BACKENDS. Continuing to accept authentication from multiple Vend shops has no complete workaround on the vulnerable backend.