Date: Mon, 10 Aug 2015 00:14:38 +0300 From: Solar Designer <solar@...nwall.com> To: Fran??ois Labr??che <f.labreche@...il.com> Cc: oss-security@...ts.openwall.com, Olivier Bilodeau <olivier@...tomlesspit.org> Subject: Re: CVE request - simple-php-captcha - captcha bypass vulnerability On Sun, Aug 09, 2015 at 03:50:10PM -0400, Fran??ois Labr??che wrote: > We found a captcha bypass vulnerability in an open source captcha > software, made by Cory LaViska for A Beautiful Site. Here is the github > repository: https://github.com/claviska/simple-php-captcha. > > We opened an issue on github > <https://github.com/claviska/simple-php-captcha/issues/16>, and the > vulnerability has been fixed. They never did any release so we don't > think the fix will be released in any form. Simply advising users to > update to git master's should suffice. > > The simple-php-captcha.php file had a vulnerability enabling a client to > generate the captcha response automatically, effectively bypassing the > captcha. > > Since the microtime() function was used both in the initial seed for the > captcha and in the captcha url path sent to the client, it was possible > to generate the captcha result automatically by running the same code > client-side. And you think removing the srand(microtime() * 100) fixes this? Well, it does appear to fix the most straightforward and easiest attack, and captchas are bypassable in general, but does this raise the bar high enough for the "fixed" version not to be CVE-worthy? Or are you going to be requesting a second CVE ID for it then? The "fixed" code relies on PHP's automatic seeding for rand() (which is typically dependent on system time anyway, adding only a process id to the mix), and, what's probably worse, it uses rand() so many times that it leaks its tiny internal state via properties of the captcha that are easy for a computer to analyze. While figuring out the captcha text might require OCR, figuring out the text length, font size, x and y position, and colors is easier. OCR isn't rocket science, but it's the intended level of "security" of this captcha, while being able to infer the text through even easier analysis of "metadata" is a captcha bypass, somewhat similar to (but moderately trickier than) your initial finding. Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.