PT-2017-6256 · Kohana Team+1 · Kohana+1

Publicado 2017-09-19 · Atualizado 2022-05-17 · CVE-2014-8684

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CodeIgniter versions prior to 3.0 Kohana versions 3.2.3 and earlier Kohana versions 3.3.x through 3.3.2

Description The issue makes it easier for remote attackers to spoof session cookies and conduct PHP object injection attacks. This is achieved by leveraging the use of standard string comparison operators to compare cryptographic hashes.

Recommendations For CodeIgniter versions prior to 3.0, update to version 3.0 or later. For Kohana versions 3.2.3 and earlier, update to a version later than 3.2.3. For Kohana versions 3.3.x through 3.3.2, update to a version later than 3.3.2.

Exploit

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2014-8684

GHSA-W9PH-Q4H9-RWQ6

Produtos afetados

Codeigniter

Kohana

Referências · 12

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/seagate_nas_php_exec_noauth.rb · Exploit
• 🔥 https://exploit-db.com/exploits/36264 · Exploit
• https://github.com/bcit-ci/CodeIgniter/blob/2.2.6/system/libraries/Session.php#L159 · Nota
• https://github.com/kohana/core/pull/492 · Nota
• https://github.com/kohana/core/commit/66b409a6da2960130888989534ff1799532b8f32 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-8684 · Nota de Segurança
• https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8684 · Nota
• http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html · Nota
• https://osv.dev/vulnerability/GHSA-w9ph-q4h9-rwq6 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2014/May/54 · Nota
• https://web.archive.org/web/20140802041151/https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection · Nota