matomo-org/matomo

SecureHash is not secure

Open

#15,278 opened on Dec 17, 2019

View on GitHub
 (4 comments) (0 reactions) (0 assignees)PHP (2,847 forks)batch import
EnhancementHelp wantedc: Securitytriaged

Repository metrics

Stars
 (21,513 stars)
PR merge metrics
 (Avg merge 8d 11h) (106 merged PRs in 30d)

Description

As reported by @Findus23

Not really a vulnerability in itself, but also not secure and might cause issues if someone uses the function without checking in the future. Therefore, I want to document it here.

The function generateSecureHash here is really not secure:

https://github.com/matomo-org/matomo/blob/e92247972a99092eb300bcbc163492542017d1b5/plugins/Login/PasswordResetter.php#L305

It hashes the string with $this->hashData which again calls Common::hash which uses the whirlpool hash which is fast and not intended for cryptographic use cases.

The splitting of data is just distraction as with 50000000 Hashes per second on a simple GTX 1060 Ti there is no need to store rainbowtables.

I guess there is no reason to not use the secure slow hashes used for passwords also for password reset tokens.

Contributor guide

Research direction
Replace the `generateSecureHash` function to use a password hashing algorithm like `password hash` with PASSWORD BCRYPT instead of the fast Whirlpool hash. Ensure the token is generated using random bytes and hashed securely.
Tech stack
php
Domain
securitybackend
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
PHP
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
70