iredmail / iRedAdmin

iRedMail Admin Panel (Open Source Edition)
https://www.iredmail.org/admin_panel.html
GNU General Public License v2.0
77 stars 28 forks source link

Password hash is accepted instead of the plaintext password #32

Open sigprof opened 3 weeks ago

sigprof commented 3 weeks ago

In iRedAdmin 2.6 it is possible to login by entering the password hash value into the login form instead of the corresponding plaintext password. This defeats any protection normally provided by password hashing (usually a leaked password hash does not give access immediately, because finding the matching plaintext password should be expensive, but with this implementation the password hash becomes equivalent to the plaintext password).

Looks like this code is the culprit — it accepts a plaintext match without the prefix even if the value stored in the database is actually a password hash: https://github.com/iredmail/iRedAdmin/blob/b537e71ecf522d7f10180f5f0aab4a98a881893a/libs/iredpwd.py#L516-L521

This kind of plaintext password matching probably should be behind some configuration option, so that the default configuration is secure.