GitHub Advisoryadvisory · Packagist

GHSA-vx8v-g3p3-88vg Weak password hash in LiveHelperChat

HIGH Published 2022-04-06 Modified 2022-04-19 Official page ↗
Aliases
CVE-2022-1235
Ecosystem
Packagist
Packages
remdex/livehelperchat
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-916
Reviewed
2022-04-07

Affected packages

• Packagist remdex/livehelperchat: < 3.96 → fixed in 3.96

Description

The secrethash, which the application relies for multiple security measures, can be brute-forced. The hash is quite small, with only 10 characters of only hexadecimal, making 16^10 possilibities ( 1.099.511.627.776 ). The SHA1 of the secret can be obtained via a captcha string and brute-forced offline with an GPU.

Related

Alias · CVE (1)

  • CVE-2022-1235 Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96. vulnerability

Weakness · CWE (1)

  • CWE-916 Use of Password Hash With Insufficient Computational Effort weakness

References