CVE-2024-48928
📋 TL;DR
Piwigo versions 14.x have a weak secret key generation vulnerability during installation. Attackers can brute-force the secret key in about one hour, potentially bypassing CSRF protection and generating certain tokens. This affects all Piwigo 14.x installations using MySQL database.
💻 Affected Systems
- Piwigo
📦 What is this software?
Piwigo by Piwigo
⚠️ Risk & Real-World Impact
Worst Case
Attackers could bypass CSRF protection, potentially perform actions as authenticated users, and generate ephemeral keys when combined with other information.
Likely Case
CSRF token bypass allowing attackers to trick authenticated users into performing unintended actions via crafted requests.
If Mitigated
Limited impact due to additional protections on auto-login keys (require password) and pwg tokens (require session ID).
🎯 Exploit Status
Brute-force attack takes approximately one hour. Requires ability to interact with the application to test CSRF tokens.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 15.0.0
Vendor Advisory: https://github.com/Piwigo/Piwigo/security/advisories/GHSA-hghg-37rg-7r42
Restart Required: No
Instructions:
1. Upgrade Piwigo to version 15.0.0 or later. 2. No database migration required. 3. The fix improves secret key generation to use more secure randomness.
🔧 Temporary Workarounds
Manually regenerate secret key
allManually set a strong secret key in Piwigo configuration
Edit local/config/database.inc.php and set $conf['secret_key'] to a strong random value (at least 32 characters)
🧯 If You Can't Patch
- Implement additional CSRF protection mechanisms at web server level
- Restrict access to Piwigo installation to trusted networks only
🔍 How to Verify
Check if Vulnerable:
Check Piwigo version in admin dashboard or by examining source files. Versions starting with 14.x are vulnerable.Check Version:
Check Piwigo admin dashboard or examine include/version.php file for version informationVerify Fix Applied:
Verify Piwigo version is 15.0.0 or higher. Check that secret_key in configuration is not using weak generation.📡 Detection & Monitoring
Log Indicators:
- Multiple failed CSRF token validations from single IP
- Unusual pattern of authentication attempts
Network Indicators:
- Rapid sequential requests testing different CSRF tokens
- Pattern of requests with incrementing token values
SIEM Query:
source="piwigo_logs" AND (message="CSRF token invalid" OR message="authentication failed") | stats count by src_ip