PT-2023-24239 · Starface · Starface

Published 2023-06-01 · Updated 2024-12-12 · CVE-2023-33243

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions STARFACE (affected versions not specified)

Description The web interface and REST API of STARFACE allow authentication using the SHA512 hash of the password instead of the cleartext password. This practice renders the protection of storing password hashes in the database ineffective, as it allows authentication using the hash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-916

Related Identifiers

CVE-2023-33243

Affected Products

Starface

References · 8

• 🔥 https://redteam-pentesting.de/en/advisories/rt-sa-2022-004/-starface-authentication-with-password-hash-possible · Exploit
• 🔥 https://exploit-db.com/exploits/51503 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-33243 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33243 · Vendor Advisory
• https://t.me/cibsecurity/65283 · Telegram Post
• https://t.me/rnetsec/18782 · Telegram Post
• https://t.me/defcon_news/114354 · Telegram Post
• https://redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses · Note