CVE-2022-24798 (published 2022-03-31T23:15Z)

Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. IRRd did not always filter password hashes in query responses relating to `mntner` objects and database exports. This may have allowed adversaries to retrieve some of these hashes, perform a brute-force search for the clear-text passphrase, and use these to make unauthorised changes to affected IRR objects. This issue only affected instances that process password hashes, which means it is limited to IRRd instances that serve authoritative databases. IRRd instances operating solely as mirrors of other IRR databases are not affected. This has been fixed in IRRd 4.2.3 and the main branch. Versions in the 4.1.x series never were affected. Users of the 4.2.x series are strongly recommended to upgrade. There are no known workarounds for this issue.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-212
cwe_name: Improper Removal of Sensitive Information Before Storage or Transfer
description: The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
extended_description: 
            Resources that may contain sensitive data include documents, packets, messages, databases, etc. While this data may be useful to an individual user or small set of users who share the resource, it may need to be removed before the resource can be shared outside of the trusted group. The process of removal is sometimes called cleansing or scrubbing.
            For example, a product for editing documents might not remove sensitive data such as reviewer comments or the local pathname where the document is stored. Or, a proxy might not remove an internal IP address from headers before making an outgoing request to an Internet site.
         
         

Fix information:
repo_url: https://github.com/irrdnet/irrd
commit_details: repo_url: https://github.com/irrdnet/irrd
author: Sasha Romijn
author_date: 2022-03-29 21:23:42+02:00
msg: Correct missing password hash removal

Auth has removal was broken in a number of cases for all 4.2 versions:
- All queries that returned the object text for a mntner when
  all hash names (MD5-PW etc.) in the text were lower or mixed case
- Queries for the auth attribute in GraphQL queries
- Queries for the objectText for journal entries in GraphQL queries

Further details in 4.2.3 release notes.

Note that this commit only has the fix and tests or coverage may
fail without the subsequent update to the tests.
repository: repo_url: https://github.com/irrdnet/irrd
repo_name: irrdnet/irrd
description: IRRd version 4
repo_language: Python
owner: irrdnet
file_changes: filename: resolvers.py
change_type: ModificationType.MODIFY
diff: @@ -187,6 +187,8 @@ def resolve_rpsl_object_journal(rpsl_object, info: GraphQLResolveInfo):
         response['operation'] = response['operation'].name
         if response['origin']:
             response['origin'] = response['origin'].name
+        if response['objectText']:
+            response['objectText'] = remove_auth_hashes(response['objectText'])
         yield response
 
 
@@ -221,7 +223,7 @@ def _rpsl_db_query_to_graphql_out(query: RPSLDatabaseQuery, info: GraphQLResolve
         object_type = resolve_rpsl_object_type(row)
         for key, value in row.get('parsed_data', dict()).items():
             if key == 'auth':
-                value = remove_auth_hashes(value)
+                value = [remove_auth_hashes(v) for v in value]
             graphql_type = schema.graphql_types[object_type][key]
             if graphql_type == 'String' and isinstance(value, list):
                 value = '\n'.join(value)

programming_language: Python
filename: text.py
change_type: ModificationType.MODIFY
diff: @@ -12,7 +12,8 @@ def remove_auth_hashes(input: Optional[str]):
     if not input:
         return input
     # If there are no hashes, skip the RE for performance.
-    if not any([pw_hash in input for pw_hash in PASSWORD_HASHERS_ALL.keys()]):
+    input_lower = input.lower()
+    if not any([pw_hash.lower() in input_lower for pw_hash in PASSWORD_HASHERS_ALL.keys()]):
         return input
     return re_remove_passwords.sub(r'\1 %s  # Filtered for security' % PASSWORD_HASH_DUMMY_VALUE, input)
 

programming_language: Python