full-disclosure - Re: [FD] Authorization bypass in PHPLiteAdmin since 1.9.5

Open Source and information security mailing list archives

Message-ID: <c2da63a8-b220-3567-5306-a304f654647e@kkoenig.net>
Date: Wed, 25 Apr 2018 10:58:09 +0200
From: Karsten König <mail@...enig.net>
To: fulldisclosure@...lists.org
Subject: Re: [FD] Authorization bypass in PHPLiteAdmin since 1.9.5

Hello,

wbowling from GitHub found out that this bug is even more serious and
can be used to bypass the authorization for arbitary passwords. The bug
is in Line 40 of classes/Authorization.php[0]. The salt is generated
with every reload. You can create cookies again and again until you have
a salt which gives you a hash like '0e179250003459658275905707244744'.
Now you can login with that specific salt and '0' as the cookie.

Best,

Karsten

[0]
https://github.com/phpLiteAdmin/pla/blob/f3998704a846ddf71539092cd6fe84f2e9c35725/classes/Authorization.php#L40

On 23.04.2018 06:41, Karsten König wrote:
> Hello,
> 
> I found a small issue in PHPLiteAdmin. It's an authorization bypass
> which works since version 1.9.5 from 2014 (current is 1.9.7.1) because
> PLA uses '==' instead of '===' for the password comparison in
> 'attemptGrant' of the 'Authorization' class. If the password is set to
> one which correspondends to a number in scientific notation, one could
> easier bruteforce the password or bypass it completely, e.g.:
> 
> php > var_dump('200' == '2e2');
> bool(true)
> php > var_dump('0' == '0e2');
> bool(true)
> php > var_dump('0' == '0e2342');
> bool(true)
> 
> I opened an issue at GitHub for this[0] and have written about it[1]
> (section 2 is the interesting one for this issue).
> 
> Best,
> 
> Karsten
> 
> [0] https://github.com/phpLiteAdmin/pla/issues/11
> [1]
> http://k3research.outerhaven.de/posts/small-mistakes-lead-to-big-problems.html
> 
> _______________________________________________
> Sent through the Full Disclosure mailing list
> https://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/
> 

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives