CVE-2024-32879Medium· 4.9▾ Sunlitsocial-auth-app-django affected by Improper Handling of Case Sensitivity
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.6%
Last analysed / modified upstream
Due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match.
This issue has been addressed by https://github.com/python-social-auth/social-app-django/pull/566 and fix released in 5.4.1.
An immediate workaround would be to change collation of the affected field:
ALTER TABLE `social_auth_usersocialauth` MODIFY `uid` varchar(255) COLLATE `utf8_bin`;
This issue was discovered by folks at https://opencraft.com/.
social-auth-app-django < 5.4.1Upgrade to a patched release:
social-auth-app-django 5.4.1Connected by shared product, vendor, weakness, or advisory.