CVE-2023-1545
📋 TL;DR
This CVE describes an SQL injection vulnerability in TeamPass password manager software versions prior to 3.0.0.23. Attackers can inject malicious SQL queries through user inputs, potentially accessing or manipulating the password database. All users running affected TeamPass versions are at risk.
💻 Affected Systems
- TeamPass
📦 What is this software?
Teampass by Teampass
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the password database, allowing attackers to exfiltrate all stored credentials, modify or delete passwords, and potentially gain administrative access to the TeamPass instance.
Likely Case
Unauthorized access to sensitive password data, credential theft, and potential lateral movement to other systems using stolen credentials.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing successful exploitation.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited; proof-of-concept details are available in public references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.0.23 and later
Vendor Advisory: https://github.com/nilsteampassnet/teampass/commit/4780252fdb600ef2ec2758f17a37d738570cbe66
Restart Required: No
Instructions:
1. Backup your TeamPass database and configuration. 2. Update TeamPass to version 3.0.0.23 or later via git pull or manual update. 3. Verify the fix by checking the version and testing functionality.
🔧 Temporary Workarounds
Input Validation Enhancement
allImplement additional input validation and sanitization for user inputs in TeamPass.
Web Application Firewall
allDeploy a WAF with SQL injection protection rules to block malicious requests.
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries in custom code
- Restrict network access to TeamPass instance and implement strong authentication controls
🔍 How to Verify
Check if Vulnerable:
Check TeamPass version in administration panel or by examining source files; versions below 3.0.0.23 are vulnerable.Check Version:
Check TeamPass admin panel or view includes/config.php for version informationVerify Fix Applied:
Confirm version is 3.0.0.23 or later and test SQL injection attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL query patterns in database logs
- Multiple failed login attempts or unusual user activity
Network Indicators:
- SQL injection patterns in HTTP requests to TeamPass endpoints
SIEM Query:
source="web_server" AND (url="*teampass*" AND (method="POST" OR method="GET") AND (content="' OR '1'='1" OR content="UNION SELECT"))🔗 References
- https://github.com/nilsteampassnet/teampass/commit/4780252fdb600ef2ec2758f17a37d738570cbe66
- https://huntr.dev/bounties/942c015f-7486-49b1-94ae-b1538d812bc2
- https://github.com/nilsteampassnet/teampass/commit/4780252fdb600ef2ec2758f17a37d738570cbe66
- https://huntr.dev/bounties/942c015f-7486-49b1-94ae-b1538d812bc2
