CVE-2020-5240 2FA bypass through deleting devices in wagtail-2fa
Attackers can delete other users' 2FA devices without permission, potentially enabling account takeover if passwords are known.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-5240?
CVE-2020-5240 is a high-severity missing authorization vulnerability in Lab Digital wagtail-2fa, published on 13 Mar 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.
Which versions are affected by CVE-2020-5240?
3 open source packages ship an affected version, including wagtail-2fa. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wagtail-2fa PyPI | All versions | 1.4.1 |
wagtail-2fa PyPI | All versions | 1.4.1 |
wagtail-2fa PyPI | All versions | 1.4.1 |
Products include Labdigital Wagtail-2fa.
How do I fix CVE-2020-5240?
Upgrade wagtail-2fa to 1.4.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-5240 being exploited?
There is no known exploitation of CVE-2020-5240 in the wild and no public exploit code.
Other vulnerabilities in Lab Digital wagtail-2fa
Sources
Also known as GHSA-9gjv-6qq6-v7qm, PYSEC-2020-219.