CVE-2024-3096 - Critical Vulnerability in PHP password_verify() Function Leading to Authentication Bypass

A critical vulnerability, designated as CVE-2024-3096, has been discovered in the widely-used PHP programming language. This vulnerability affects the password_verify() function and can lead to authentication bypass if the stored password hash begins with a null byte (\x00).

Affected PHP versions are 8.1.* before 8.1.28, 8.2.* before 8.2.18, and 8.3.* before 8.3.5. If you haven't updated your PHP version, this vulnerability may still be lurking within your system, leaving it open to potential authentication bypass attacks.

In this post, we'll provide a brief overview of the vulnerability, a detailed explanation of the exploit, a code snippet demonstrating the security flaw, and links to official references.

A Brief Overview of the Vulnerability

The PHP password_verify() function is widely used to verify the correctness of user-supplied passwords against stored password hashes. It is generally considered reliable and secure for this purpose. However, the CVE-2024-3096 vulnerability occurs when a password stored using the password_hash() function starts with a null byte (\x00). In this case, password_verify() will incorrectly validate an empty string as a valid password.

Exploit Details

The vulnerability arises when the password hash stored in the database begins with a null byte. When using the password_verify() function to check the user-supplied password against the stored hash, the function will return true for an empty string. This incorrect validation can potentially allow attackers to authenticate themselves without knowing the correct password.

Code Snippet

// Sample password hash stored with password_hash() starting with a null byte
$stored_password_hash = "\x00my$trng@p#$$wrd";

// The following will incorrectly return true when the user submits an empty string
$is_authenticated = password_verify("", $stored_password_hash);

if ($is_authenticated) {
    echo "Authentication successful, welcome!";
} else {
    echo "Authentication failed, try again.";
}

In the example above, the $is_authenticated variable will be set to true when an empty string is submitted by the user. This leads to a successful authentication response, even though the proper password was not provided.

How to Fix

If you are using one of the affected PHP versions, the recommended solution is to update your PHP installation to the latest available version: PHP 8.1.28, 8.2.18, or 8.3.5 or later. This ensures that your system has the necessary security patches in place to remain protected from this vulnerability, as well as other potential issues.

Official References

- CVE-2024-3096 - National Vulnerability Database (NVD)
- PHP Official Website
- PHP Release Announcement (8.1.28, 8.2.18, 8.3.5)

Conclusion

CVE-2024-3096 is a serious vulnerability affecting several PHP versions that could lead to authentication bypass if the stored password hash starts with a null byte. By updating your PHP installation to the latest available version, you can protect your system from this and other known security issues. Stay vigilant and keep PHP installations up-to-date to ensure the continued safety of your web applications.

Timeline

Published on: 04/29/2024 04:15:08 UTC
Last modified on: 06/10/2024 18:15:36 UTC