CVE-2023-0567: A Critical Vulnerability in PHP's password_verify() Function Allowing Invalid Blowfish Hashes

A recently discovered vulnerability known as CVE-2023-0567 affects PHP versions 8..X before 8..28, 8.1.X before 8.1.16, and 8.2.X before 8.2.3. This critical vulnerability impacts the password_verify() function, and it may lead to accepting some invalid Blowfish hashes as valid. If these invalid hashes make their way into a password database, they could potentially lead to an application allowing any password for that entry as valid—effectively breaking the authentication mechanism.

In this detailed post, we will discuss the vulnerability, show a code snippet for exploiting it, provide links to original references and reports, and explain how developers can protect their applications from this security flaw.

Code Snippet

The vulnerable code is in the password_verify() function, which is typically used to validate user-provided passwords against hashed values stored in a password database. Here's a simplified example of using the password_verify() function:

<?php
    // User provided password
    $user_password = 'user123';

    // Password hash retrieved from the password database
    $stored_password_hash = '$2y$10$INVALIDBlFISHHHHHHHHH.'

    // Validate the user-provided password using password_verify()
    if (password_verify($user_password, $stored_password_hash)) {
        echo "Access granted!";
    } else {
        echo "Access denied!";
    }
?>

In this example, the $stored_password_hash variable contains an invalid Blowfish hash. Due to the CVE-2023-0567 vulnerability, the password_verify() function will return true, and the script will grant access even though the provided password does not match the (invalid) stored hash.

References

For more information about the CVE-2023-0567 vulnerability, consult the following original references and reports:

1. The CVE entry in the National Vulnerability Database (NVD): https://nvd.nist.gov/vuln/detail/CVE-2023-0567
2. The changelog for PHP 8..28, which includes a fix for the vulnerability: https://www.php.net/ChangeLog-8.php#8..28
3. The changelog for PHP 8.1.16, which also incorporates a fix for the vulnerability: https://www.php.net/ChangeLog-8.php#8.1.16
4. The PHP bug report where the vulnerability was first reported: https://bugs.php.net/bug.php?id=81797

Exploit Details

An attacker can exploit the CVE-2023-0567 vulnerability by inserting an invalid Blowfish hash into the password database. Once the invalid hash is in the database, any password provided for that hash will be considered valid by the vulnerable password_verify() function, giving the attacker access to the application or system in question.

To protect against this attack, developers should ensure that they are using a version of PHP that is not affected by the vulnerability and should validate stored password hashes before using them in the password_verify() function.

Mitigation

To mitigate the CVE-2023-0567 vulnerability, developers should upgrade their PHP installations to version 8..28, 8.1.16, or 8.2.3, as appropriate. These versions contain fixes for the vulnerability, rendering the exploit ineffective in these versions.

Additionally, developers should implement proper input validation and sanitization techniques to prevent invalid hashes from being stored in the password database in the first place.

Conclusion

CVE-2023-0567 is a critical security vulnerability that affects PHP's password_verify() function. By exploiting this vulnerability, an attacker can potentially access applications and systems by providing any password for an entry with an invalid Blowfish hash. Developers should take immediate action to update their PHP installations and implement proper input validation and sanitization to protect against this security flaw.

Timeline

Published on: 03/01/2023 08:15:00 UTC
Last modified on: 03/10/2023 17:32:00 UTC