CVE-2021-3990 (published 2021-12-01T11:15Z)

showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-338
cwe_name: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
description: The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
extended_description: 
            When a non-cryptographic PRNG is used in a cryptographic context, it can expose the cryptography to certain types of attacks.
            Often a pseudo-random number generator (PRNG) is not designed for cryptography. Sometimes a mediocre source of randomness is sufficient or preferable for algorithms that use random numbers. Weak generators generally take less processing power and/or do not use the precious, finite, entropy sources on a system. While such PRNGs might have very useful features, these same features could be used to break the cryptography.
         
         

Fix information:
repo_url: https://github.com/star7th/showdoc
commit_details: repo_url: https://github.com/star7th/showdoc
author: star7th
author_date: 2021-11-20 20:58:35+08:00
msg: Enhanced LDAP user password / 增强ldap用户密码
repository: repo_url: https://github.com/star7th/showdoc
repo_name: star7th/showdoc
description: ShowDoc is a tool greatly applicable for an IT team to share documents online一个非常适合IT团队的在线API文档、技术文档工具
repo_language: JavaScript
owner: star7th
file_changes: filename: AdminSettingController.class.php
change_type: ModificationType.MODIFY
diff: @@ -100,7 +100,7 @@ class AdminSettingController extends BaseController {
                 }
                 //如果该用户不在数据库里，则帮助其注册
                 if(!D("User")->isExist($ldap_user)){
-                    D("User")->register($ldap_user,$ldap_user.time());
+                    D("User")->register($ldap_user,$ldap_user.get_rand_str());
                 }
             }
             D("Options")->set("ldap_form" , json_encode( $ldap_form)) ;
@@ -221,7 +221,7 @@ class AdminSettingController extends BaseController {
                     //如果该用户不在数据库里，则帮助其注册
                     $userInfo = D("User")->isExist($username) ;
                     if(!$userInfo){
-                        D("User")->register($ldap_user,$ldap_user.time());
+                        D("User")->register($ldap_user,$ldap_user.get_rand_str());
                     }
                     $rs2=ldap_bind($ldap_conn, $dn , $password);
                     if ($rs2) {

programming_language: PHP
filename: UserModel.class.php
change_type: ModificationType.MODIFY
diff: @@ -92,7 +92,7 @@ class UserModel extends BaseModel {
                     //如果该用户不在数据库里，则帮助其注册
                     $userInfo = D("User")->isExist($username) ;
                     if(!$userInfo){
-                        D("User")->register($ldap_user,$ldap_user.time());
+                        D("User")->register($ldap_user,$ldap_user.get_rand_str());
                     }
                     $rs2=ldap_bind($ldap_conn, $dn , $password);
                     if ($rs2) {

programming_language: PHP
filename: function.php
change_type: ModificationType.MODIFY
diff: @@ -212,4 +212,21 @@ function uncompress_string($string){
 function env($name , $default_value = false){
     return getenv($name) ? getenv($name) : $default_value ;
 
+}
+
+// 获取随机字符串
+function get_rand_str($len = 32 ){
+    // 对于php7以上版本，可利用random_bytes产生随机
+    if(version_compare(PHP_VERSION,'7.0','>')){
+        $rand = bin2hex( random_bytes( 16 ) ); 
+        return substr($rand,0,$len); 
+    }else{
+        // 对于低版本，只好尽量加大长度实现伪随机，增大暴力破解难度
+        $s1 = microtime(true).time().rand().rand().rand().microtime(true).time().rand().rand().rand();
+        $s2 = microtime(true).time().rand().rand().rand().microtime(true).time().rand().rand().rand();
+        $md5 = md5($s2.base64_encode($s1));
+        return substr($md5,0,$len);
+    }
+
+    
 }
\ No newline at end of file

programming_language: PHP