PT-2021-10885 · Codiad · Codiad

Peng-Hui · Published 2021-01-27 · Updated 2022-05-24 · CVE-2020-23355

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Codiad version 2.8.4

Description The issue concerns a magic hash authentication bypass vulnerability. It affects the Authenticate() function in the class.user.php file. Specifically, if the encrypted or hash value for passwords matches certain formats of magic hash, such as 0e123, another hash value like 0e234 can successfully authenticate. This allows for unauthorized access.

Recommendations For Codiad version 2.8.4, as a temporary workaround, consider disabling the Authenticate() function in the class.user.php file until a patch is available. Restrict access to the /componetns/user/class.user.php endpoint to minimize the risk of exploitation. Avoid using the 0e123 and 0e234 hash values in the affected authentication process until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-697

CWE-287

Related Identifiers

CVE-2020-23355

GHSA-8FHH-HF9W-55P7

Affected Products

Codiad

References · 7

• https://osv.dev/vulnerability/CVE-2020-23355 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8fhh-hf9w-55p7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23355 · Security Note
• https://github.com/Codiad/Codiad · Note
• https://github.com/Codiad/Codiad/issues/1121 · Note
• https://web.archive.org/web/20160722013412/https://whitehatsec.com/blog/magic-hashes · Note
• https://t.me/cibsecurity/22719 · Telegram Post