PT-2023-27216 · Oppia · Oppia
U8Nwxd
·
Published
2023-08-16
·
Updated
2023-08-25
·
CVE-2023-40021
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Oppia versions prior to 3.3.2-hotfix-2
Description
Oppia is an online learning platform. When comparing a received CSRF token against the expected token, Oppia uses the string equality operator (
==), which is not safe against timing attacks. By repeatedly submitting invalid tokens, an attacker can brute-force the expected CSRF token character by character. Once they have recovered the token, they can then submit a forged request on behalf of a logged-in user and execute privileged actions on that user's behalf. In particular, the function to validate received CSRF tokens is at oppia.core.controllers.base.CsrfTokenManager.is csrf token valid. An attacker who can lure a logged-in Oppia user to a malicious website can perform any change on Oppia that the user is authorized to do, including changing profile information; creating, deleting, and changing explorations; etc. Note that the attacker cannot change a user's login credentials. An attack would need to complete within 1 second because every second, the time used in computing the token changes.Recommendations
To resolve the issue, upgrade to Oppia version 3.3.2-hotfix-2 or later. As a temporary workaround, consider restricting access to sensitive features until the upgrade is applied. Note that there are no known workarounds for this vulnerability.
Exploit
Fix
Side Channel Attack
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Oppia