CVE-2022-37783: 
PHP Schwachstellenanalyse und -minderung

Craft CMS versions between 3.0.0 and 3.7.32 were found to disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. The vulnerability was discovered during a penetration test by researchers at TÜV Trust IT Austria and was assigned CVE-2022-37783. The issue was fixed in version 3.7.33 (CVES AT, NVD).

The vulnerability stems from bad coding practices where user password hashes were mixed into CSRF-Tokens. The password hashes were disclosed in two locations: the CRAFT_CSRF_TOKEN cookie (URL-encoded) and the CSRF-Token in the HTML page. While the cookie was protected by the HTTP-Only attribute, the HTML token was masked using a YII Framework function that could be reversed using publicly available unmasking functions. The passwords were hashed using bcrypt, which is considered a slow hash algorithm (CVES AT).

The disclosure of password hashes could allow attackers to attempt offline password cracking. If successful, attackers could gain unauthorized access to user accounts. Users utilizing SAML-Login were not affected by this vulnerability. The vulnerability received a CVSS v3.1 score of 7.5 (High), indicating significant potential impact (CVES AT).

While the password hash in the cookie was protected by HTTP-Only attribute, the CSRF-Token in the HTML was vulnerable to exfiltration through XSS attacks. The masked token could be unmasked using modifications to publicly available YII Framework functions (CVES AT).

The vulnerability was fixed in Craft CMS version 3.7.33. Users of affected versions are strongly encouraged to upgrade to at least version 3.7.33. The vendor marked release 3.7.33 as critical and integrated warning messages in affected versions urging users to update (CVES AT).