A serious authentication bypass vulnerability has been reported by some researchers to exist at Bouncy Castle, a popular open-source encryption library.
When exploited, vulnerabilities (CVE-2020-28052) could allow an attacker to gain access to user or administrator accounts due to cryptographic inability to control of passwords.
Bouncy Castle is a set of encryption APIs used by both Java and C # / .NET developers when creating security applications without having to worry about releasing their own cryptographic algorithms.
This week, two researchers Matti Varanka and Tero Rontti from the Synopsys Cybersecurity Research Center revealed a vulnerability to bypassing authentication at Bouncy Castle.
The defect, referred to as CVE-2020-28052, is in the Bouncy Castle OpenBSDBcrypt category that applies the Bcrypt hashing password algorithm.
That is, the Bcrypt.doCheckPassword () function that is responsible for executing the byte byte matching password hash has incorrect logic.
"The code controls an index of characters from 0 to 59, instead of controlling that characters in positions from 0 to 59 fit ", says the report published by Synopsys.
"This means that passwords ending in hashes that, for example, do not contain bytes between 0x00 and 0x3B match any other hash password that does not. This control means that one intruder there is no need to match byte-for-byte with the stored hash value ", the report continues.
What it essentially ends up with is brute-forcing a set of strings that will yield a hash, which compared to the doCheckPassword () function returns a true result (i.e. the matching is successful).
While strong passwords take a long time to break through brute-forcing, this application defect reduces "short circuits" in the verification routine.
"Some password hashes require more effort, determined by the number of bytes ranging between 0 and 60 (1 to 59). In addition, our research shows that all password hashes can bypass with several attempts. In rare cases, some password hashes can be bypassed with any input, ”the company report said.
Bcrypt authentication, according to researchers, is used for authentication in web applications and API.
Vulnerability has been assigned a high severity score of CVSS 3.1.
According to the researchers, both Bouncy Castle 1.65 and 1.66 are affected by this defect but not the publications before 1.65. Bouncy Castle has implemented a fix for this vulnerability in versions 1.67 and above and developers are encouraged to implement the upgrade.
Source of information: bleepingcomputer.com