CVE-2022-1235: Use of Password Hash With Insufficient Computational Effort (CWE-916)
value: Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96.
CWE description: The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
CVSS v3 base score: 8.2
Published: 2022-04-05T07:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/cli/lib/install.php, lhc_web/modules/lhcaptcha/captchastring.php, lhc_web/modules/lhinstall/install.php
Commit date: 2022-03-31 00:39:39 -0400
Commit message: Increase size of secret hash and chagne it's algorithm

Diff: diff --git a/lhc_web/cli/lib/install.php b/lhc_web/cli/lib/install.php
index c57094475cd..497b3bc5f93 100644
--- a/lhc_web/cli/lib/install.php
+++ b/lhc_web/cli/lib/install.php
@@ -82,11 +82,11 @@ class Install
         if (count($Errors) == 0) {
             $cfgSite = erConfigClassLhConfig::getInstance();
             foreach ($database as $key => $value) {
                 $cfgSite->setSetting( 'db', $key, $value);
             }
-            $cfgSite->setSetting( 'site', 'secrethash', substr(md5(time() . ":" . mt_rand()),0,10));
+            $cfgSite->setSetting( 'site', 'secrethash', erLhcoreClassChat::generateHash(80));
             return true;
         } else {
             return $Errors;
         }
     }
diff --git a/lhc_web/modules/lhcaptcha/captchastring.php b/lhc_web/modules/lhcaptcha/captchastring.php
index f287fcfdc28..8674894a981 100644
--- a/lhc_web/modules/lhcaptcha/captchastring.php
+++ b/lhc_web/modules/lhcaptcha/captchastring.php
@@ -6,11 +6,11 @@ header('Expires: Sat, 26 Jul 1997 05:00:00 GMT' );
 header('Last-Modified: ' . gmdate( 'D, d M Y H:i:s',time()+60*60*8 ) . ' GMT' );
 header('Cache-Control: no-store, no-cache, must-revalidate' );
 header('Cache-Control: post-check=0, pre-check=0', false );
 header('Pragma: no-cache' );
 
-$hash = sha1(erLhcoreClassIPDetect::getIP().$Params['user_parameters']['timets'].erConfigClassLhConfig::getInstance()->getSetting( 'site', 'secrethash' ));
+$hash = sha1(erLhcoreClassIPDetect::getIP() . $Params['user_parameters']['timets'] . erConfigClassLhConfig::getInstance()->getSetting( 'site', 'secrethash' ));
 
 if ( (time()-$Params['user_parameters']['timets']) > 600 || (time()-($Params['user_parameters']['timets'] - 5)) < 0) {
 	echo json_encode(array('result' => 'false'));
 	exit;
 }
diff --git a/lhc_web/modules/lhinstall/install.php b/lhc_web/modules/lhinstall/install.php
index acfbe5f5078..86a995b8fa4 100644
--- a/lhc_web/modules/lhinstall/install.php
+++ b/lhc_web/modules/lhinstall/install.php
@@ -162,11 +162,11 @@ try {
                 $cfgSite->setSetting( 'db', 'host', $form->DatabaseHost);
                 $cfgSite->setSetting( 'db', 'user', $form->DatabaseUsername);
                 $cfgSite->setSetting( 'db', 'password', $form->DatabasePassword);
                 $cfgSite->setSetting( 'db', 'database', $form->DatabaseDatabaseName);
                 $cfgSite->setSetting( 'db', 'port', $form->DatabasePort);
-                $cfgSite->setSetting( 'site', 'secrethash', (!empty(getenv('LHC_SECRET_HASH')) ? getenv('LHC_SECRET_HASH') : substr(md5(time() . ":" . mt_rand()),0,10)));
+                $cfgSite->setSetting( 'site', 'secrethash', (!empty(getenv('LHC_SECRET_HASH')) ? getenv('LHC_SECRET_HASH') : erLhcoreClassChat::generateHash(80)));
                 $cfgSite->save();
 
                 $tpl->setFile('lhinstall/install3.tpl.php');
             } else {
 

Vulnerable code:             $cfgSite->setSetting( 'site', 'secrethash', substr(md5(time() . ":" . mt_rand()),0,10));
$hash = sha1(erLhcoreClassIPDetect::getIP().$Params['user_parameters']['timets'].erConfigClassLhConfig::getInstance()->getSetting( 'site', 'secrethash' ));
                $cfgSite->setSetting( 'site', 'secrethash', (!empty(getenv('LHC_SECRET_HASH')) ? getenv('LHC_SECRET_HASH') : substr(md5(time() . ":" . mt_rand()),0,10)));
Fixed code:             $cfgSite->setSetting( 'site', 'secrethash', erLhcoreClassChat::generateHash(80));
$hash = sha1(erLhcoreClassIPDetect::getIP() . $Params['user_parameters']['timets'] . erConfigClassLhConfig::getInstance()->getSetting( 'site', 'secrethash' ));
                $cfgSite->setSetting( 'site', 'secrethash', (!empty(getenv('LHC_SECRET_HASH')) ? getenv('LHC_SECRET_HASH') : erLhcoreClassChat::generateHash(80)));