PT-2020-19495 · Ctfd · Ctfd

Stefan2904 · Published 2020-01-23 · Updated 2020-01-31 · CVE-2020-7245

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CTFd versions 2.0.0 through 2.2.2

Description The issue arises from incorrect username validation in the registration process, allowing an attacker to take over an arbitrary account if the username is known and emails are enabled. To exploit this, an attacker registers with a username identical to the victim's but with added white space, causing a username collision. This results in the victim's account password being reset when a password reset is initiated for the new account.

Recommendations For CTFd versions 2.0.0 through 2.2.2, as a temporary workaround, consider disabling email functionality on the CTFd instance to prevent password reset exploitation. Restrict access to the registration process to minimize the risk of arbitrary account takeover. Avoid using whitespace in usernames to prevent collisions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2020-7245

Affected Products

Ctfd

References · 4

• https://osv.dev/vulnerability/CVE-2020-7245 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7245 · Security Note
• https://github.com/CTFd/CTFd/pull/1218 · Note
• https://github.com/CTFd/CTFd/releases/tag/2.2.3 · Note