Skip to content

Tracking hash vulnerability #20

Description

@nkboedecker

Each visitor gets a hash that keys their recorded IPs and user agents and that hash is the only thing protecting that data and the "Clear my Data" action.

index.php at 70: $HASH=SHA1(mt_rand());

mt_rand() returns an integer in [0, 2147483647], so at most 2^31 hashes are ever produced and each is just sha1() of that integer. The output is a 40-hex-digit string that be easily enumerated offline. Anyone who computes sha1(0) through sha1(2147483647) has every hash the site can issue and can then read each one's data through ?ajax and wipe it through ?clear.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions