CVE-2024-21543

djoser <2.3.0 allows authentication bypass via database query fallback, bypassing custom authentication checks.

• CVSS 5.7
• CWE-287
• Authentication, Authorization, and Session Management
• Remote

Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.

CVE

CVE-2024-21543

CWE

CWE-287

CVSS base score

5.7

Published

2024-12-13

OWASP

A02 Broken Authentication

Orthogonal defect classification

Interface

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Insecure Authentication Mechanisms

Accessibility scope

Remote

Impact

Unauthorized Access

Affected component

djoser

Fixed by upgrading

Yes

Solution

Upgrade djoser to version 2.3.0 or later.

from django.contrib.auth import authenticate
from django.http import HttpResponse

def login(request):
    # VULNERABLE: This code is susceptible to sql injection
    username = request.POST.get('username')
    password = request.POST.get('password')

    user = authenticate(request, username=username, password=password)

    if user is None:
        from django.contrib.auth.models import User
        try:
            user = User.objects.get(username=username)  
            if user.check_password(password):
                request.session['user_id'] = user.id
                return HttpResponse("Logged in successfully (vulnerable)")  
            else:
                return HttpResponse("Invalid credentials")
        except User.DoesNotExist:
            return HttpResponse("Invalid credentials")
    else:
        request.session['user_id'] = user.id
        return HttpResponse("Logged in successfully (secure)")

from django.contrib.auth import authenticate, login
from django.http import HttpResponse
from django.contrib.auth.models import User
from django.contrib.auth import get_user_model
from django.contrib.auth.signals import user_logged_in
from django.views.decorators.csrf import csrf_exempt

@csrf_exempt
def login_view(request):
    # SECURE: This version prevents sql injection
    username = request.POST.get('username')
    password = request.POST.get('password')

    user = authenticate(request, username=username, password=password)

    if user is not None:
        login(request, user)
        return HttpResponse("Logged in successfully")

    return HttpResponse("Invalid credentials", status=401)

@misc{vaitp:cve202421543,
  title        = {{djoser <2.3.0 allows authentication bypass via database query fallback, bypassing custom authentication checks.
}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-21543},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-21543/}}
}