Weak Hashing Algorithm in PHP Censor
Summary
CVE-2024-34914: PHP Censor uses a weak hashing algorithm for the remember me key. Affects php-censor/php-censor across 2 version ranges.
< 2.0.13
>= 2.1.0, < 2.1.5
Fixed in 2.0.13 or 2.1.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP Censor is an open-source continuous integration server that is used to automate the testing and building of PHP projects. It provides a web interface for managing projects, configuring build steps, and viewing build results. The remember me feature in PHP Censor allows users to stay logged in even after closing the browser. However, the implementation of the remember me key in versions 2.1.4 and below utilizes a weak hashing algorithm, making it susceptible to brute force attacks.
Vulnerability Detail
The vulnerability in PHP Censor arises from the use of a weak hashing algorithm for the remember_key value. This allows attackers to potentially guess or brute force the remember_key value, giving them unauthorized access to accounts that have checked the 'remember me' option during login. By gaining access to these accounts, attackers can perform various malicious actions, such as modifying project configurations, altering build results, or accessing sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.0.132.0.13composer require php-censor/php-censor:2.0.13 -
>= 2.1.0, < 2.1.52.1.5composer require php-censor/php-censor:2.1.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the latest version of PHP Censor.
Conclusion
The weak hashing algorithm vulnerability in PHP Censor can potentially lead to unauthorized access and malicious actions. It is crucial to upgrade to the latest version (2.1.5 or later) to mitigate this vulnerability. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for php-censor/php-censor →
FAQ
PHP Censor is an open-source continuous integration server for PHP projects. It automates the testing and building of PHP projects and provides a web interface for managing projects and viewing build results.
The remember me feature in PHP Censor allows users to stay logged in even after closing the browser. It eliminates the need to enter login credentials every time the user accesses PHP Censor.
A weak hashing algorithm is one that can be easily reversed or brute forced. It does not provide sufficient protection against unauthorized access or tampering.
Attackers can exploit this vulnerability by guessing or brute forcing the remember_key value used in the remember me feature. If successful, they can gain unauthorized access to accounts and perform malicious actions.
You can use Vulert's playground (https://vulert.com/scanner) to check if your PHP Censor installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, providing valuable insights without requiring access to the code or installation.
