CVE-2024-51478
📋 TL;DR
This vulnerability in YesWiki allows attackers to recover password reset keys due to weak cryptography and a hard-coded salt. Attackers can then reset passwords for any user account, potentially gaining unauthorized access. All YesWiki instances prior to version 4.4.5 are affected.
💻 Affected Systems
- YesWiki
📦 What is this software?
Yeswiki by Yeswiki
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover of all user accounts including administrators, leading to full system compromise, data theft, and potential privilege escalation.
Likely Case
Unauthorized password resets for user accounts, enabling attackers to access sensitive information, modify content, or perform actions as legitimate users.
If Mitigated
Limited impact if password reset functionality is disabled or additional authentication controls are in place.
🎯 Exploit Status
The vulnerability is straightforward to exploit once the cryptographic weakness is understood. No authentication is required to trigger password reset functionality.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.4.5
Vendor Advisory: https://github.com/YesWiki/yeswiki/security/advisories/GHSA-4fvx-h823-38v3
Restart Required: No
Instructions:
1. Backup your YesWiki installation and database. 2. Download YesWiki 4.4.5 or later from the official repository. 3. Replace the existing installation files with the new version. 4. Verify that the patch is applied by checking the version.
🔧 Temporary Workarounds
Disable Password Reset Functionality
allTemporarily disable the password reset feature to prevent exploitation while planning for patching.
Modify YesWiki configuration to remove or disable password reset links and functionality
🧯 If You Can't Patch
- Implement network-level controls to restrict access to password reset endpoints
- Enable multi-factor authentication for all user accounts to mitigate impact of password resets
🔍 How to Verify
Check if Vulnerable:
Check the YesWiki version in the administration panel or by examining the source code for version markers.Check Version:
Check the YesWiki admin panel or look for version information in the source files.Verify Fix Applied:
Verify that the version is 4.4.5 or higher and check that the cryptographic functions for password reset use proper algorithms and unique salts.📡 Detection & Monitoring
Log Indicators:
- Unusual number of password reset requests
- Password reset attempts from unexpected IP addresses
- Successful password resets followed by immediate login attempts
Network Indicators:
- HTTP requests to password reset endpoints with predictable parameters
- Multiple reset attempts targeting different usernames
SIEM Query:
source="web_logs" AND (url="*/password/reset*" OR url="*/mot-de-passe-oublie*") AND status=200 | stats count by src_ip