Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2023-38492— Kirby vulnerable to denial of service from unlimited password lengths

Quick assessment

Affected
getkirby kirby
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Kirby是一套基于文件的内容管理系统（CMS）。 Kirby 3.5.8.2版本及之前版本、3.6.0到3.6.6.2版本 、3.7.0到3.7.5.1版本、3.8.0到3.8.4版本、3.9.0到3.9.5版本存在安全漏洞，该漏洞源于Kirby 的身份验证端点不限制密码长度，攻击者利用该漏洞可以导致网站无响应或不可用。

CVSS 5.3 · Medium EPSS 1.18% · P67
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-38492

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Kirby vulnerable to denial of service from unlimited password lengths
Source: CVE Program / CVE List V5
Vulnerability Description
Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). The real-world impact of this vulnerability is limited, however we still recommend to update to one of the patch releases because they also fix more severe vulnerabilities. Kirby's authentication endpoint did not limit the password length. This allowed attackers to provide a password with a length up to the server's maximum request body length. Validating that password against the user's actual password requires hashing the provided password, which requires more CPU and memory resources (and therefore processing time) the longer the provided password gets. This could be abused by an attacker to cause the website to become unresponsive or unavailable. Because Kirby comes with a built-in brute force protection, the impact of this vulnerability is limited to 10 failed logins from each IP address and 10 failed logins for each existing user per hour. The problem has been patched in Kirby 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6. In all of the mentioned releases, the maintainers have added password length limits in the affected code so that passwords longer than 1000 bytes are immediately blocked, both when setting a password and when logging in.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Vulnerability Title
Kirby 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Kirby是一套基于文件的内容管理系统（CMS）。 Kirby 3.5.8.2版本及之前版本、3.6.0到3.6.6.2版本 、3.7.0到3.7.5.1版本、3.8.0到3.8.4版本、3.9.0到3.9.5版本存在安全漏洞，该漏洞源于Kirby 的身份验证端点不限制密码长度，攻击者利用该漏洞可以导致网站无响应或不可用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
getkirby kirby < 3.5.8.3 -

II. Public POCs for CVE-2023-38492

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-38492

请登录查看更多情报信息。

Patches & Fixes for CVE-2023-38492 (1)

Vendor Advisories for CVE-2023-38492 (1)

Other References for CVE-2023-38492 (5)

Same Patch Batch · getkirby · 2023-07-27 · 5 CVEs total

CVE-2023-38489 7.3 HIGH Kirby vulnerable to Insufficient Session Expiration after a password change
CVE-2023-38488 7.1 HIGH Kirby vulnerable to field injection in the KirbyData text storage handler
CVE-2023-38490 6.8 MEDIUM Kirby XML External Entity (XXE) vulnerability in the XML data handler
CVE-2023-38491 5.7 MEDIUM Kirby vulnerable to Cross-site scripting (XSS) from MIME type auto-detection of uploaded f

IV. Related Vulnerabilities

Same product: kirby
Same vendor: getkirby
Same weakness: CWE-770

V. Comments for CVE-2023-38492

No comments yet

Leave a comment