PT-2023-21223 · Unknown · Codeigniter Shield

Lonnieezell · Published 2023-03-13 · Updated 2023-03-23 · CVE-2023-27580

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CodeIgniter Shield versions 1.0.0-beta.3 and earlier

Description An improper implementation was found in the password storage process, making all hashed passwords stored in affected versions easier to crack than expected. If an attacker obtains the user's hashed password and the hashed password (SHA-384 hash without salt) from another source, they may easily crack the user's password.

Recommendations Upgrade to Shield v1.0.0-beta.4 or later to fix this issue. After upgrading, all users’ hashed passwords should be updated (saved to the database).

Exploit

Fix

Weakness Enumeration

CWE-916

Related Identifiers

CVE-2023-27580

GHSA-C5VJ-F36Q-P9VG

Affected Products

Codeigniter Shield

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27580.json · Exploit
• https://github.com/codeigniter4/shield/security/advisories/GHSA-c5vj-f36q-p9vg · Vendor Advisory
• https://github.com/codeigniter4/shield/commit/ea9688dd01d100193d834117dbfc2cfabcf9ea0b · Patch
• https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27580 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27580 · Security Note
• https://osv.dev/vulnerability/GHSA-c5vj-f36q-p9vg · Vendor Advisory
• https://github.com/codeigniter4/shield · Note
• https://t.me/cibsecurity/59928 · Telegram Post
• https://scottbrady91.com/authentication/beware-of-password-shucking · Note
• https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwords · Note
• https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html · Note
• https://t.me/cvenotify/46711 · Telegram Post