CVE-2021-21352 (published 2021-03-03T01:15Z)

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password reset feature in Time Tracker are based on system time and, therefore, are predictable. This opens a window for brute force attacks to guess user tokens and, once successful, change user passwords, including that of a system administrator. This vulnerability is pathced in version 1.19.24.5415 (started to use more secure tokens) with an additional improvement in 1.19.24.5416 (limited an available window for brute force token guessing).

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-330
cwe_name: Use of Insufficiently Random Values
description: The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
extended_description: When product generates predictable values in a context requiring unpredictability, it may be possible for an attacker to guess the next value that will be generated, and use this guess to impersonate another user or access sensitive information.
         

Fix information:
repo_url: https://github.com/anuko/timetracker
commit_details: repo_url: https://github.com/anuko/timetracker
author: Nik Okuntseff
author_date: 2021-02-27 16:00:53+00:00
msg: Fixed a critical security vulnerability with password resets.
repository: repo_url: https://github.com/anuko/timetracker
repo_name: anuko/timetracker
description: Simple, easy to use, open source time tracking system.
repo_language: PHP
owner: anuko
file_changes: filename: report.tpl
change_type: ModificationType.MODIFY
diff: @@ -117,6 +117,7 @@
         {if $bean->getAttribute('chtimesheet')}<td></td>{/if}
         {if $bean->getAttribute('chfiles')}<td></td>{/if}
         {if $use_checkboxes}<td></td>{/if}
+        {* <td></td>{* column for edit icons *}
       </tr>
       <tr><td>&nbsp;</td></tr>
       {/if}
@@ -171,6 +172,7 @@
       {if 1 == $item.type}<td bgcolor="white"><input type="checkbox" name="log_id_{$item.id}"></td>{/if}
       {if 2 == $item.type}<td bgcolor="white"><input type="checkbox" name="item_id_{$item.id}"></td>{/if}
     {/if}
+     {* <td><a href="time_edit.php?id={$item.id}"><img class="table_icon" alt="{$i18n.label.edit}" src="img/icon-edit.png"></a></td>{* column for edit icons *}
       </tr>
     {if $note_on_separate_row && $bean->getAttribute('chnote') && $item.note}
       <tr>
@@ -220,6 +222,7 @@
     {if $bean->getAttribute('chtimesheet')}<td></td>{/if}
     {if $bean->getAttribute('chfiles')}<td></td>{/if}
     {if $use_checkboxes}<td></td>{/if}
+    {* <td></td>{* column for edit icons *}
       </tr>
   {/if}
   <!-- print totals -->
@@ -261,6 +264,7 @@
     {if $bean->getAttribute('chtimesheet')}<td></td>{/if}
     {if $bean->getAttribute('chfiles')}<td></td>{/if}
     {if $use_checkboxes}<td></td>{/if}
+    {* <td></td>{* column for edit icons *}
       </tr>
 {/if}
     </table>

programming_language: Perl
filename: initialize.php
change_type: ModificationType.MODIFY
diff: @@ -13,7 +13,7 @@ error_reporting(E_ALL & ~E_NOTICE & ~E_STRICT); // & ~E_DEPRECATED);
 ini_set('display_errors', 'Off');
 
 // require_once('init_auth.php');
-define("APP_VERSION", "1.19.23.5414");
+define("APP_VERSION", "1.19.24.5415");
 define("APP_DIR", dirname(__FILE__));
 define("LIBRARY_DIR", APP_DIR."/WEB-INF/lib");
 define("TEMPLATE_DIR", APP_DIR."/WEB-INF/templates");

programming_language: PHP
filename: password_reset.php
change_type: ModificationType.MODIFY
diff: @@ -46,7 +46,10 @@ if ($request->isPost()) {
 
   if ($err->no()) {
     // Prepare and save a temporary reference for user.
-    $temp_ref = md5(uniqid());
+    $cryptographically_strong = true;
+    $random_bytes = openssl_random_pseudo_bytes(16, $cryptographically_strong);
+    if ($random_bytes === false) die ("openssl_random_pseudo_bytes function call failed...");
+    $temp_ref = bin2hex($random_bytes);
     ttUserHelper::saveTmpRef($temp_ref, $user->id);
 
     $user_i18n = null;

programming_language: PHP