PT-2023-26473 · Kirby · Kirby

5Hank4R · Published 2023-07-27 · Updated 2023-08-03 · CVE-2023-38492

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 3.5.8.3 Kirby versions prior to 3.6.6.3 Kirby versions prior to 3.7.5.2 Kirby versions prior to 3.8.4.1 Kirby versions prior to 3.9.6

Description The issue affects Kirby sites with user accounts, unless Kirby's API and Panel are disabled in the config. The real-world impact of this issue is limited. However, updating to one of the patch releases is recommended because they also fix more severe issues. Kirby's authentication endpoint did not limit the password length, allowing attackers to provide a password with a length up to the server's maximum request body length. Validating that password against the user's actual password requires hashing the provided password, which requires more CPU and memory resources the longer the provided password gets. This could be abused by an attacker to cause the website to become unresponsive or unavailable. Because Kirby comes with a built-in brute force protection, the impact of this issue is limited to 10 failed logins from each IP address and 10 failed logins for each existing user per hour.

Recommendations Update to Kirby version 3.5.8.3 or later to fix the vulnerability. Update to Kirby version 3.6.6.3 or later to fix the vulnerability. Update to Kirby version 3.7.5.2 or later to fix the vulnerability. Update to Kirby version 3.8.4.1 or later to fix the vulnerability. Update to Kirby version 3.9.6 or later to fix the vulnerability.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2023-38492

GHSA-3V6J-V3QC-CXFF

Affected Products

Kirby

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38492.json · Exploit
• https://osv.dev/vulnerability/GHSA-3v6j-v3qc-cxff · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-38492 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38492 · Security Note
• https://github.com/getkirby/kirby · Note
• https://github.com/getkirby/kirby/security/advisories/GHSA-3v6j-v3qc-cxff · Note
• https://github.com/getkirby/kirby/releases/tag/3.8.4.1 · Note
• https://github.com/getkirby/kirby/commit/0e10ce3b0c2b88656564b8ff518ddc99136ac43e · Note
• https://github.com/getkirby/kirby/releases/tag/3.6.6.3 · Note
• https://github.com/getkirby/kirby/releases/tag/3.5.8.3 · Note
• https://github.com/getkirby/kirby/releases/tag/3.7.5.2 · Note
• https://github.com/getkirby/kirby/releases/tag/3.9.6 · Note
• https://t.me/cibsecurity/67337 · Telegram Post