CVE-2019-19735
📋 TL;DR
This vulnerability in YetiShare allows attackers to guess password reset tokens by brute-forcing predictable hashes based on microtime. Attackers can reset any user's password and gain unauthorized access. All YetiShare installations running affected versions are vulnerable.
💻 Affected Systems
- MFScripts YetiShare
📦 What is this software?
Yetishare by Mfscripts
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover of any user, including administrators, leading to data theft, privilege escalation, and full system compromise.
Likely Case
Unauthorized access to user accounts, potential data exfiltration, and lateral movement within the application.
If Mitigated
Limited impact with proper monitoring and rate limiting, but still a serious authentication bypass vulnerability.
🎯 Exploit Status
Exploit scripts are publicly available on GitHub. Attack requires no authentication and can be automated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.5.4 and later
Vendor Advisory: https://mfscripts.com/
Restart Required: No
Instructions:
1. Backup your YetiShare installation and database. 2. Download the latest version from the official vendor. 3. Replace the vulnerable class.userpeer.php file with the patched version. 4. Verify the fix by testing password reset functionality.
🔧 Temporary Workarounds
Disable Password Reset
allTemporarily disable password reset functionality to prevent exploitation.
# Modify YetiShare configuration to disable password reset feature
Implement Rate Limiting
allAdd rate limiting to password reset requests to make brute-force attacks impractical.
# Configure web server or application firewall to limit requests to /account/reset_password
🧯 If You Can't Patch
- Implement strong network segmentation to isolate the vulnerable system
- Enable detailed logging and monitoring for password reset attempts
🔍 How to Verify
Check if Vulnerable:
Check the version of YetiShare installed. If between 3.5.2 and 4.5.3 inclusive, the system is vulnerable.Check Version:
grep -r 'version' /path/to/yetishare/config/ or check admin panelVerify Fix Applied:
Verify that class.userpeer.php has been updated to version 4.5.4 or later. Test password reset functionality to ensure it uses cryptographically secure tokens.📡 Detection & Monitoring
Log Indicators:
- Unusual volume of password reset requests
- Multiple failed password reset attempts from single IP
- Successful password resets for accounts that didn't request them
Network Indicators:
- HTTP POST requests to /account/reset_password with predictable token patterns
- Brute-force patterns in request timing
SIEM Query:
source="web_logs" AND (url="/account/reset_password" AND status=200) | stats count by src_ip | where count > 10