GHSA-h76r-vgf3-j6w5

Suggest an improvement
Source
https://github.com/advisories/GHSA-h76r-vgf3-j6w5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-h76r-vgf3-j6w5/GHSA-h76r-vgf3-j6w5.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-h76r-vgf3-j6w5
Aliases
Published
2021-08-30T16:13:50Z
Modified
2023-11-08T04:05:35.595690Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
October CMS auth bypass and account takeover
Details

Impact

An attacker can exploit this vulnerability to bypass authentication using a specially crafted persist cookie.

  • To exploit this vulnerability, an attacker must obtain a Laravel’s secret key for cookie encryption and signing.
  • Due to the logic of how this mechanism works, a targeted user account must be logged in while the attacker is exploiting the vulnerability.
  • Authorization via persist cookie not shown in access logs.

Patches

Workarounds

Apply https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374 and https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9 to your installation manually if you are unable to upgrade.

[Update 2022-01-20] Shortened patch instructions can be found here.

Recommendations

We recommend the following steps to make sure your server stays secure:

  • Keep server OS and system software up to date.
  • Keep October CMS software up to date.
  • Use a multi-factor authentication plugin.
  • Change the default backend URL or block public access to the backend area.
  • Include the Roave/SecurityAdvisories Composer package to ensure that your application doesn't have installed dependencies with known security vulnerabilities.

References

Bugs found as part of Solar Security CMS Research. Credits to: • Andrey Basarygin • Andrey Guzei • Mikhail Khramenkov • Alexander Sidukov • Maxim Teplykh

For more information

If you have any questions or comments about this advisory: * Email us at hello@octobercms.com

Database specific 
{
    "nvd_published_at": "2021-08-26T19:15:00Z",
    "github_reviewed_at": "2021-08-26T20:09:50Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-287"
    ]
}
References

Affected packages

Packagist / october/system

Package

Name
october/system
Purl
pkg:composer/october/system

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.0.472

Affected versions

v1.*

v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471

Packagist / october/system

Package

Name
october/system
Purl
pkg:composer/october/system

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.1.1
Fixed
1.1.5

Affected versions

v1.*

v1.1.1
v1.1.2
v1.1.3
v1.1.4