CVE-2019-16766 2FA bypass in Wagtail through new device path
Attackers with valid credentials can bypass two-factor authentication by manipulating the URL to add a new device and gain full CMS access.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-16766?
CVE-2019-16766 is a high-severity authentication bypass vulnerability in Lab Digital wagtail-2fa, published on 29 Nov 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0.
Which versions are affected by CVE-2019-16766?
3 open source packages ship an affected version, including wagtail-2fa. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wagtail-2fa PyPI | All versions | 1.3.0 |
wagtail-2fa PyPI | All versions | 1.3.0 |
wagtail-2fa PyPI | All versions | 1.3.0 |
Products include Labdigital Wagtail-2fa.
How do I fix CVE-2019-16766?
Upgrade wagtail-2fa to 1.3.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-16766 being exploited?
There is no known exploitation of CVE-2019-16766 in the wild and no public exploit code.
Other vulnerabilities in Lab Digital wagtail-2fa
Sources
Also known as GHSA-89px-ww3j-g2mm, PYSEC-2019-135.