Opened 17 months ago

Last modified 17 months ago

#34661 closed New feature

Peppering user passwords — at Version 7

Reported by: Fatih Erikli Owned by: nobody
Component: contrib.auth Version: 4.2
Severity: Normal Keywords:
Cc: Triage Stage: Unreviewed
Has patch: no Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description (last modified by Fatih Erikli)

Currently a user's password stored in database in this format:

<algorithm>$<iterations>$<salt>$<hash>

The salt is a random generated string per user. Hash (Last column) is the password hashed with the stored in previous column.

Example, these are two computed passwords, stored on database, for the same password of two users.

pbkdf2_sha256$600000$fb9cUsHWK4EMZ7VWGBAcGD$2uwiVefFwanIhxLrv+/t3sKvP4X6tDKEMw/ysHD5dIc=
pbkdf2_sha256$600000$HgWHWrF2qQD9Owj4XeEkjY$rh0qzfo+/ZCzWbL9ZJa8aKhiO5xoEMfT4EtP/+A+LzI=

The password is 123456.

Imagine I am an attacker, who got the database of different django project, I want to look up the users who have chosen the password 123456.

I have the salts of users stored in database.

make_password('123456', 'fb9cUsHWK4EMZ7VWGBAcGD')
pbkdf2_sha256$600000$fb9cUsHWK4EMZ7VWGBAcGD$2uwiVefFwanIhxLrv+/t3sKvP4X6tDKEMw/ysHD5dIc=

make_password('123456', 'HgWHWrF2qQD9Owj4XeEkjY')
pbkdf2_sha256$600000$HgWHWrF2qQD9Owj4XeEkjY$rh0qzfo+/ZCzWbL9ZJa8aKhiO5xoEMfT4EtP/+A+LzI=

These are correct password combinations. I am able to lookup the users who have their passwords exposed in public.

There is one more element needed for hashing the password, pepper, should be django project specific. Even when a database is exposed, the attacker will not be able to lookup the known passwords, since they don't have the secret pepper key.

I am not sure about the vulnerability enumeration, however this cause CWE-760 even though salt is not weak, but it is known, when a database is exposed. Because the salt is stored next to the hashed password.

I think peppering passwords should be default behavior of django.

Change History (7)

comment:1 by Fatih Erikli, 17 months ago

Description: modified (diff)

comment:2 by Fatih Erikli, 17 months ago

Description: modified (diff)

comment:3 by Fatih Erikli, 17 months ago

Description: modified (diff)

comment:4 by Fatih Erikli, 17 months ago

Description: modified (diff)

comment:5 by Fatih Erikli, 17 months ago

Description: modified (diff)

comment:6 by Fatih Erikli, 17 months ago

Description: modified (diff)

comment:7 by Fatih Erikli, 17 months ago

Description: modified (diff)
Note: See TracTickets for help on using tickets.
Back to Top