CVE-2024-32879

Case-insensitive user IDs in Python Social Auth could cause mismatches.

• CVSS 4.9
• CWE-178
• Authentication, Authorization, and Session Management
• Remote

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. This issue has been addressed by a fix released in version 5.4.1. An immediate workaround would be to change collation of the affected field.

CVE

CVE-2024-32879

CWE

CWE-178

CVSS base score

4.9

Published

2024-04-24

OWASP

A01 Broken Authentication

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Insecure Authentication Mechanisms

Accessibility scope

Remote

Impact

Unauthorized Access

Affected component

Python Socia

Fixed by upgrading

Yes

Solution

Upgrade to Python Social Auth version 5.4.1 or later.

from social_core.backends.google import GoogleOAuth2

class CustomGoogleOAuth2(GoogleOAuth2):
    def get_user_details(self, response):
        user_id = response['id'].lower()
        email = response['email']
        return {'username': user_id, 'email': email}

AUTHENTICATION_BACKENDS = (
    'path.to.CustomGoogleOAuth2'
)

from social_core.backends.google import GoogleOAuth2
import re

class CustomGoogleOAuth2(GoogleOAuth2):
    def get_user_details(self, response):
        user_id = response.get('id', '').strip().lower()
        email = response.get('email', '').strip()

        if not user_id or not email:
            raise ValueError("Missing required user information from Google response")

        if not re.match(r"[^@]+@[^@]+\.[^@]+", email):
            raise ValueError("Invalid email format")

        return {'username': user_id, 'email': email}

AUTHENTICATION_BACKENDS = (
    'path.to.CustomGoogleOAuth2',
)

{
  "id": "exampleUser ",
  "email": "user@example.com"
}

@misc{vaitp:cve202432879,
  title        = {{Case-insensitive user IDs in Python Social Auth could cause mismatches.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-32879},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-32879/}}
}