Wagtail up to 2.7.1/2.8.1 String Comparison timing discrepancy

Summaryinfo

A vulnerability classified as critical has been found in Wagtail up to 2.7.1/2.8.1. Impacted is an unknown function of the component String Comparison. The manipulation leads to timing discrepancy. This vulnerability is listed as CVE-2020-11037. The attack must be carried out locally. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Wagtail up to 2.7.1/2.8.1 and classified as problematic. This issue affects some unknown processing of the component String Comparison. The manipulation with an unknown input leads to a timing discrepancy vulnerability. Using CWE to declare the problem leads to CWE-208. Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. Impacted is confidentiality. The summary by CVE is:

In Wagtail before versions 2.7.2 and 2.8.2, a potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is performed through a character-by-character string comparison, and so an attacker who is able to measure the time taken by this check to a high degree of accuracy could potentially use timing differences to gain knowledge of the password. This is understood to be feasible on a local network, but not on the public internet. Privacy settings that restrict access to pages/documents on a per-user or per-group basis (as opposed to a shared password) are unaffected by this vulnerability. This has been patched in 2.7.3, 2.8.2, 2.9.

The weakness was presented 04/30/2020 (GitHub Repository). It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2020-11037 since 03/30/2020. The exploitation is known to be difficult. Attacking locally is a requirement. Additional levels of successful authentication are necessary for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 2.7.2 or 2.8.2 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Wagtail

Version

• 2.7.0
• 2.7.1
• 2.8.0
• 2.8.1

Website

• Product: https://github.com/wagtail/wagtail/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion