CVE-2023-0793 (published 2023-02-12T14:15Z)

Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11.\n\n

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-521
cwe_name: Weak Password Requirements
description: The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
extended_description: Authentication mechanisms often rely on a memorized secret (also known as a password) to provide an assertion of identity for a user of a system. It is therefore important that this password be of sufficient complexity and impractical for an adversary to guess. The specific requirements around how complex a password needs to be depends on the type of system being protected. Selecting the correct password requirements and enforcing them through implementation are critical to the overall success of the authentication mechanism.
         

Fix information:
repo_url: https://github.com/thorsten/phpmyfaq
commit_details: repo_url: https://github.com/thorsten/phpmyfaq
author: Thorsten Rinne
author_date: 2023-01-23 08:23:30+01:00
msg: fix: added missing check on password length
repository: repo_url: https://github.com/thorsten/phpmyfaq
repo_name: thorsten/phpMyFAQ
description: phpMyFAQ - Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases
repo_language: PHP
owner: thorsten
file_changes: filename: ajax.user.php
change_type: ModificationType.MODIFY
diff: @@ -120,6 +120,7 @@ if (
             $userName = Filter::filterVar($postData['userName'], FILTER_UNSAFE_RAW);
             $userRealName = Filter::filterVar($postData['realName'], FILTER_UNSAFE_RAW);
             $userEmail = Filter::filterVar($postData['email'], FILTER_VALIDATE_EMAIL);
+            $automaticPassword = Filter::filterVar($postData['automaticPassword'], FILTER_VALIDATE_BOOLEAN);
             $userPassword = Filter::filterVar($postData['password'], FILTER_UNSAFE_RAW);
             $userPasswordConfirm = Filter::filterVar($postData['passwordConfirm'], FILTER_UNSAFE_RAW);
             $userIsSuperAdmin = Filter::filterVar($postData['isSuperAdmin'], FILTER_VALIDATE_BOOLEAN);
@@ -138,6 +139,12 @@ if (
             if (is_null($userEmail)) {
                 $errorMessage[] = $PMF_LANG['ad_user_error_noEmail'];
             }
+            if (!$automaticPassword) {
+                if (strlen($userPassword) <= 7 || strlen($userPasswordConfirm) <= 7) {
+                    $errorMessage[] = $PMF_LANG['ad_passwd_fail'];
+                }
+            }
+
             if (count($errorMessage) === 0) {
                 if (!$newUser->createUser($userName, $userPassword)) {
                     $errorMessage[] = $newUser->error();
@@ -204,6 +211,12 @@ if (
                 exit(1);
             }
 
+            if (strlen($newPassword) <= 7 || strlen($retypedPassword) <= 7) {
+                $http->setStatus(400);
+                $http->sendJsonWithHeaders(['error' => $PMF_LANG['ad_passwd_fail']]);
+                exit(1);
+            }
+
             $user->getUserById($userId, true);
             $auth = new Auth($faqConfig);
             $authSource = $auth->selectAuth($user->getAuthSource('name'));

programming_language: PHP
filename: user.js
change_type: ModificationType.MODIFY
diff: @@ -157,6 +157,7 @@ document.addEventListener('DOMContentLoaded', () => {
       const userName = document.getElementById('add_user_name').value;
       const realName = document.getElementById('add_user_realname').value;
       const email = document.getElementById('add_user_email').value;
+      const automaticPassword = document.getElementById('add_user_automatic_password').checked;
       const password = document.getElementById('add_user_password').value;
       const passwordConfirm = document.getElementById('add_user_password_confirm').value;
       const isSuperAdmin = document.querySelector('#add_user_is_superadmin').checked;
@@ -167,6 +168,7 @@ document.addEventListener('DOMContentLoaded', () => {
         userName,
         realName,
         email,
+        automaticPassword,
         password,
         passwordConfirm,
         isSuperAdmin,

programming_language: TypeScript
filename: user.php
change_type: ModificationType.MODIFY
diff: @@ -444,7 +444,8 @@ if (
                       <?= $PMF_LANG['ad_passwd_new'] ?>
                   </label>
                   <div class="col-lg-8">
-                    <input type="password" autocomplete="off" name="npass" id="npass" class="form-control" required>
+                    <input type="password" autocomplete="off" name="npass" id="npass" class="form-control" minlength="8"
+                           required>
                   </div>
                 </div>
 
@@ -453,7 +454,8 @@ if (
                       <?= $PMF_LANG['ad_passwd_con'] ?>
                   </label>
                   <div class="col-lg-8">
-                    <input type="password" autocomplete="off" name="bpass" id="bpass" class="form-control" required>
+                    <input type="password" autocomplete="off" name="bpass" id="bpass" class="form-control" minlength="8"
+                           required>
                   </div>
                 </div>
 
@@ -684,7 +686,7 @@ if (
                        for="add_user_password"><?= $PMF_LANG['ad_adus_password'] ?></label>
                 <div class="col-lg-8">
                   <input type="password" name="add_user_password" id="add_user_password" class="form-control"
-                         autocomplete="off" tabindex="4">
+                         minlength="8" autocomplete="off" tabindex="4">
                 </div>
               </div>
 
@@ -693,7 +695,7 @@ if (
                        for="add_user_password_confirm"><?= $PMF_LANG['ad_passwd_con'] ?></label>
                 <div class="col-lg-8">
                   <input type="password" name="add_user_password_confirm" id="add_user_password_confirm"
-                         class="form-control" autocomplete="off" tabindex="5">
+                         minlength="8" class="form-control" autocomplete="off" tabindex="5">
                 </div>
               </div>
             </div>

programming_language: PHP