Authentication Bypass in Python Social Auth

Executive Summary

Python Social Auth before version 5.0.0 has a flaw in its partial-pipeline resume mechanism. It accepted partial_token as a bearer credential without linking it to the browser session that created it. This allowed attackers to hijack authentication flows started by victims, potentially authenticating victims as the attacker's account.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if your Python Social Auth version is below 5.0.0. Use commands like 'pip show social-auth-app-django' or 'pip list | grep social-auth' to verify the installed version. Inspect application logs for partial pipeline usage patterns, especially with steps like 'mail_validation' or custom '@partial' decorated steps.

Useful 0 Not Useful 0

Impact Analysis

If you use applications with resumable partial pipeline steps like mail_validation, an attacker could trick you into resuming an attacker-controlled authentication flow. This could lead to your account being compromised, allowing the attacker to access your data or perform actions on your behalf.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Python Social Auth to version 5.0.0 or later immediately. Review authentication flows using partial pipeline steps and remove or secure any custom '@partial' decorated steps. Monitor for unauthorized account access or authentication attempts.

Useful 0 Not Useful 0