Cartalyst Sentry account takeover via null password reset codes

Severity: high · CVSS 8.9 · Published 2024-05-15

A security flaw in the Sentry authentication library, used by the OpenCFP conference management system, allows unauthorized individuals to take over user accounts. By exploiting a weakness in how the system verifies password reset requests, an attacker can reset the password of any user who does not have an active reset request pending. This could lead to a full compromise of the platform, including access to sensitive speaker data and administrative controls.

Vendors: Packagist.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 8.9, published 15 May 2024.
Which products and versions are affected?
OpenCFP All versions using Sentry < 2.1.7; cartalyst/sentry (Packagist) < 2.1.7.
Is there a fix for This vulnerability?
A patch was published on 2016-09-05: Sentry version 2.1.7 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run OpenCFP or cartalyst/sentry (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the `checkResetPasswordCode()` function within the Cartalyst Sentry authentication framework. The database schema defaults the `reset_password_code` column to NULL for users who have not requested a password reset. Due to loose comparison or improper validation, providing a NULL value (via a missing parameter or a URL null byte `%00`) in the password reset request causes the check to return true. An attacker can exploit this by sending a POST request to the password update endpoint with a target `user_id` and a null `reset_code`. While the attacker needs to know the victim's email to log in after the reset, numeric user IDs are often predictable (e.g., IDs 1-5 for administrators). The issue is fixed in Sentry version 2.1.7.

Affected products

  • Cartalyst Sentry < 2.1.7
  • OpenCFP OpenCFP All versions using Sentry < 2.1.7

Timeline

  • 2016-08-31: disclosed: Bug reported to OpenCFP and patch submitted to Sentry
  • 2016-09-05: patched: Sentry version 2.1.7 released
  • 2024-05-15: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.