Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1qNzJmLWg3NTItbXg0d84AA3VH

Insertion of Sensitive Information into Log

Impact

If successful login attempts are recorded, the raw tokens are stored in the log table.
If a malicious person somehow views the data in the log table, he or she can obtain a raw token, which can then be used to send a request with that user's authority.

When you (1) use the following authentiactors,

• AccessTokens (tokens)
• JWT (jwt)
• HmacSha256 (hmac)

and you (2) log successful login attempts, the raw tokens are stored.

Patches

Upgrade to Shield v1.0.0-beta.8 or later.

Workarounds

Disable logging for successful login attempts by the configuration files.

• AccessTokens or HmacSha256
  • Set Config\AuthToken::$recordLoginAttempt to Auth::RECORD_LOGIN_ATTEMPT_FAILURE or Auth::RECORD_LOGIN_ATTEMPT_NONE
• JWT
  • Set Config\AuthJWT::$recordLoginAttempt to Auth::RECORD_LOGIN_ATTEMPT_FAILURE or Auth::RECORD_LOGIN_ATTEMPT_NONE

References

• https://codeigniter4.github.io/shield/getting_started/authenticators/

For more information

If you have any questions or comments about this advisory:

• Open an issue or discussion in codeigniter4/shield
• Email us at [email protected]

Permalink: https://github.com/advisories/GHSA-j72f-h752-mx4w
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qNzJmLWg3NTItbXg0d84AA3VH
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 5 months ago
Updated: 5 months ago

CVSS Score: 5.0
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N

Identifiers: GHSA-j72f-h752-mx4w, CVE-2023-48708
References:

• https://github.com/codeigniter4/shield/security/advisories/GHSA-j72f-h752-mx4w
• https://github.com/codeigniter4/shield/commit/7e84c3fb3411294f70890819bfe51781bb9dc8e4
• https://nvd.nist.gov/vuln/detail/CVE-2023-48708
• https://codeigniter4.github.io/shield/getting_started/authenticators/
• https://github.com/advisories/GHSA-j72f-h752-mx4w

Repository: https://github.com/codeigniter4/shield
Blast Radius: 7.7

Affected Packages