search

benedmunds / CodeIgniter-Ion-Auth

Simple and Lightweight Auth System for CodeIgniter
http://benedmunds.com/ion_auth/
MIT License
2.35k stars 1.14k forks source link

Security Issue: Potential timing attack when using '===' to compare password hashes #1555

Closed dvicedo closed 2 years ago

dvicedo commented 2 years ago

Hi Team, First of all, thanks for taking the time to read this. I was looking for timing attacks in public repositories and find a security issue similar to a previous one https://github.com/benedmunds/CodeIgniter-Ion-Auth/issues/1089 but in another code section:

A simple strict equals sign === is used for hash comparison, which is vulnerable to timing attack. I think that hash_equals() could be used instead. It's seems that this portion of code is part of the legacy _password_verify_sha1_legacy function so I don't know if you want to fix it or not, but only want to notice you.

Have a great week, Thanks!

benedmunds commented 2 years ago

Great catch, thanks for this! Updated here: https://github.com/benedmunds/CodeIgniter-Ion-Auth/commit/f08cd919e79d6783d24583cb30008d7c6c640d40