CVE-2022-24976 (published 2022-02-14T12:15Z)

Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/atheme/atheme
commit_details: repo_url: https://github.com/atheme/atheme
author: Ed Kellett
author_date: 2021-10-17 14:13:22+01:00
msg: saslserv/main: Track EID we're pending login to

The existing model does not remember that we've sent a SVSLOGIN for a
given SASL session, and simply assumes that if a client is introduced
with a SASL session open, that session must have succeeded. The security
of this approach requires ircd to implicitly abort SASL sessions on
client registration.

This also means that if a client successfully authenticates and then
does something else its pending login is forgotten about, even though a
SVSLOGIN has been sent for it, and the ircd is going to think it's
logged in.

This change removes the dependency on ircd's state machine by keeping
explicit track of the pending login, i.e. the one we've most recently
sent a SVSLOGIN for. The next commit will ensure that a client abort
(even an implicit one) doesn't blow that information away.
repository: repo_url: https://github.com/atheme/atheme
repo_name: atheme/atheme
description: Atheme IRC Services
repo_language: C
owner: atheme
file_changes: filename: sasl.h
change_type: ModificationType.MODIFY
diff: @@ -62,6 +62,7 @@ struct sasl_session
 	char                            authzid[NICKLEN + 1];   // Authorization identity (user being logged in)
 	char                            authceid[IDLEN + 1];    // Entity ID for authcid
 	char                            authzeid[IDLEN + 1];    // Entity ID for authzid
+	char                            pendingeid[IDLEN + 1];  // Entity ID for pending login (for pre-reg clients)
 	char                            uid[UIDLEN + 1];        // Network UID
 };
 

programming_language: C
filename: main.c
change_type: ModificationType.MODIFY
diff: @@ -385,15 +385,15 @@ sasl_handle_login(struct sasl_session *const restrict p, struct user *const u, s
 	// Find the account if necessary
 	if (! mu)
 	{
-		if (! *p->authzeid)
+		if (! *p->pendingeid)
 		{
-			(void) slog(LG_INFO, "%s: session for '%s' without an authzeid (BUG)",
+			(void) slog(LG_INFO, "%s: session for '%s' without an pendingeid (BUG)",
 			                     MOWGLI_FUNC_NAME, u->nick);
 			(void) notice(saslsvs->nick, u->nick, LOGIN_CANCELLED_STR);
 			return false;
 		}
 
-		if (! (mu = myuser_find_uid(p->authzeid)))
+		if (! (mu = myuser_find_uid(p->pendingeid)))
 		{
 			if (*p->authzid)
 				(void) notice(saslsvs->nick, u->nick, "Account %s dropped; login cancelled",
@@ -638,6 +638,8 @@ sasl_process_packet(struct sasl_session *const restrict p, char *const restrict
 				return false;
 			}
 
+			(void) mowgli_strlcpy(p->pendingeid, p->authzeid, sizeof p->pendingeid);
+
 			/* If the user is already on the network, attempt to log them in immediately.
 			 * Otherwise, we will log them in on introduction of user to network
 			 */

programming_language: C