CVE-2024-39329

What it actually does

The ModelBackend.authenticate() method in affected Django versions leaks information about user existence through measurable differences in response timing when processing login requests for accounts configured with unusable passwords.

Why it matters to the business

Attackers can systematically discover valid usernames in Django-based applications, increasing the risk of targeted credential stuffing or social engineering; the issue affects Debian-packaged Django deployments and requires prompt patching to maintain user privacy controls.

How an attack unfolds

An attacker crafts repeated login attempts against the Django authentication endpoint, comparing response latencies between known-invalid usernames and potential valid ones that have unusable passwords set, thereby building a list of enumerated accounts without triggering authentication failures.

How to fix it

Upgrade Django to version 5.0.7 or 4.2.14 or later. For Debian 12 systems apply package version 6.1.94-1 or newer; for Debian 13 systems apply package version 6.8.11-1 or newer. Restart affected services after package installation and verify no custom authentication backends override the patched behavior.

How to confirm the fix worked

Confirm installed Django version meets or exceeds the fixed releases, review authentication backend configuration for reliance on ModelBackend, and test that login timing is now consistent regardless of password usability state.

Typical attack path

1. Identify Django login endpoint handling ModelBackend authentication
2. Prepare lists of candidate usernames and observe baseline timing for non-existent users
3. Submit login requests for accounts known to have unusable passwords and measure timing deltas
4. Correlate slower or faster responses to infer valid user accounts
5. Use enumerated usernames for subsequent attacks such as password spraying

How to detect it

Review web server and application logs for unusually high volumes of authentication requests with diverse usernames originating from single sources; look for patterns of login attempts that do not result in account lockouts or error messages.

What your security team should do

• Apply the listed Debian package updates immediately given the public disclosure date
• Audit all applications using django.contrib.auth for custom unusable password configurations
• Monitor authentication endpoint logs for high volumes of login attempts with varying usernames
• Consider rate limiting and consistent timing responses on authentication paths as defense in depth