CVE-2023-49032
📋 TL;DR
CVE-2023-49032 is a critical vulnerability in LTB Self Service Password that allows remote attackers to hijack SMS verification codes and send them to arbitrary phone numbers. This enables attackers to bypass authentication, execute arbitrary code, and access sensitive information. All organizations using LTB Self Service Password versions before 1.5.4 are affected.
💻 Affected Systems
- LTB Self Service Password
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution, administrative access to the password reset system, and potential lateral movement to connected systems.
Likely Case
Unauthorized password resets for user accounts, privilege escalation, and potential access to sensitive user data.
If Mitigated
Limited impact with proper network segmentation, strong authentication controls, and monitoring in place.
🎯 Exploit Status
Proof of concept code is publicly available, making exploitation straightforward for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.4
Vendor Advisory: https://github.com/ltb-project/self-service-password/issues/816
Restart Required: Yes
Instructions:
1. Backup current configuration and data. 2. Download version 1.5.4 from the official repository. 3. Replace existing installation with the patched version. 4. Restart the web service. 5. Verify functionality.
🔧 Temporary Workarounds
Disable SMS Verification
allTemporarily disable SMS-based password reset functionality to prevent exploitation
Edit configuration file to set 'sms' => false in authentication settings
Network Restriction
linuxRestrict access to the self-service password portal to trusted IP ranges only
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP_RANGE -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP_RANGE -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the vulnerable system
- Enable detailed logging and monitoring for all SMS verification attempts
🔍 How to Verify
Check if Vulnerable:
Check the version number in the application's admin interface or configuration files. If version is below 1.5.4, the system is vulnerable.Check Version:
grep -i version /path/to/self-service-password/config/*.php or check the web interface footerVerify Fix Applied:
After patching, verify the version shows 1.5.4 or higher and test SMS verification functionality with controlled tests.📡 Detection & Monitoring
Log Indicators:
- Multiple failed SMS verification attempts from single IP
- SMS verification requests to unusual phone numbers
- Unusual patterns in password reset logs
Network Indicators:
- Unusual spikes in traffic to SMS API endpoints
- Requests to SMS verification endpoints from unexpected sources
SIEM Query:
source="self-service-password.log" AND (sms_verification OR password_reset) AND status="success" | stats count by src_ip, phone_number