CVE-2019-10682
📋 TL;DR
This vulnerability in django-nopassword before version 5.0.0 stores authentication secrets in cleartext in the database, allowing attackers with database access to compromise user accounts. It affects any Django application using django-nopassword for passwordless authentication.
💻 Affected Systems
- django-nopassword
📦 What is this software?
Django Nopassword by Django Nopassword Project
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover of all users if database is compromised, leading to data breaches, privilege escalation, and lateral movement.
Likely Case
Attackers with database access can impersonate users, bypass authentication, and access sensitive application data.
If Mitigated
Limited impact if database is properly secured with encryption at rest, strict access controls, and network segmentation.
🎯 Exploit Status
Exploitation requires database access; once obtained, cleartext secrets are directly readable without additional steps.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.0.0
Vendor Advisory: https://github.com/relekang/django-nopassword/commit/d8b4615f5fbfe3997d96cf4cb3e342406396193c
Restart Required: Yes
Instructions:
1. Update django-nopassword to version 5.0.0 or later using pip: pip install django-nopassword>=5.0.0
2. Restart your Django application
3. Existing cleartext secrets remain vulnerable; consider forcing new authentication tokens for all users
🔧 Temporary Workarounds
Database Encryption
allImplement transparent database encryption to protect stored secrets
Access Restriction
allImplement strict database access controls and network segmentation
🧯 If You Can't Patch
- Implement database field-level encryption for the authentication secrets table
- Migrate to alternative authentication methods and disable django-nopassword
🔍 How to Verify
Check if Vulnerable:
Check django-nopassword version in requirements.txt or via pip show django-nopasswordCheck Version:
pip show django-nopassword | grep VersionVerify Fix Applied:
Verify version is 5.0.0 or higher and inspect database to confirm secrets are no longer stored in cleartext📡 Detection & Monitoring
Log Indicators:
- Unusual database access patterns
- Multiple failed authentication attempts followed by success
Network Indicators:
- Unexpected database connections
- SQL queries targeting authentication tables
SIEM Query:
source="database_logs" AND (table="nopassword_*" OR query="SELECT * FROM nopassword_*")🔗 References
- https://github.com/relekang/django-nopassword/blob/8e8cfc765ee00adfed120c2c79bf71ef856e9022/nopassword/models.py#L14
- https://github.com/relekang/django-nopassword/commit/d8b4615f5fbfe3997d96cf4cb3e342406396193c
- https://github.com/relekang/django-nopassword/compare/v4.0.1...v5.0.0
- https://github.com/relekang/django-nopassword/blob/8e8cfc765ee00adfed120c2c79bf71ef856e9022/nopassword/models.py#L14
- https://github.com/relekang/django-nopassword/commit/d8b4615f5fbfe3997d96cf4cb3e342406396193c
- https://github.com/relekang/django-nopassword/compare/v4.0.1...v5.0.0
