PT-2023-21223 · Unknown · Codeigniter Shield

Lonnieezell · Publicado 2023-03-13 · Atualizado 2023-03-23 · CVE-2023-27580

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CodeIgniter Shield versions 1.0.0-beta.3 and earlier

Description An improper implementation was found in the password storage process, making all hashed passwords stored in affected versions easier to crack than expected. If an attacker obtains the user's hashed password and the hashed password (SHA-384 hash without salt) from another source, they may easily crack the user's password.

Recommendations Upgrade to Shield v1.0.0-beta.4 or later to fix this issue. After upgrading, all users’ hashed passwords should be updated (saved to the database).

Exploit

Correção

Enumeração de Fraquezas

CWE-916

Identificadores relacionados

CVE-2023-27580

GHSA-C5VJ-F36Q-P9VG

Produtos afetados

Codeigniter Shield

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27580.json · Exploit
• https://github.com/codeigniter4/shield/security/advisories/GHSA-c5vj-f36q-p9vg · Aviso do Fabricante
• https://github.com/codeigniter4/shield/commit/ea9688dd01d100193d834117dbfc2cfabcf9ea0b · Correção
• https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md · Aviso do Fabricante
• https://github.com/codeigniter4/shield · Nota
• https://osv.dev/vulnerability/CVE-2023-27580 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-27580 · Nota de Segurança
• https://t.me/cibsecurity/59928 · Publicação no Telegram
• https://scottbrady91.com/authentication/beware-of-password-shucking · Nota
• https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwords · Nota
• https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html · Nota
• https://osv.dev/vulnerability/GHSA-c5vj-f36q-p9vg · Aviso do Fabricante
• https://t.me/cvenotify/46711 · Publicação no Telegram