oss-security - CVE request - TelescopeJS Information Leakage: User BCrypt password hash post-authentication

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAG8UnYPVfOtdRd4G7wcUQtJdRZYJS04AcpMadL0EPj0M_wUKHA@mail.gmail.com>
Date: Sun, 26 Apr 2015 16:56:48 +1000
From: Shubham Shah <admin@...bh.am>
To: oss-security@...ts.openwall.com
Subject: CVE request - TelescopeJS Information Leakage: User BCrypt password
 hash post-authentication

Hi,

TelescopeJS leaks the users BCrypt password hash in incoming websocket
messages once the user has authenticated. Due to the fact that TelescopeJS
is an expressjs web application, it uses the model of storing session
information in the browsers localStorage.

This means that if an attacker is able to find a single cross-site
scripting flaw in MeteorJS, they would then be able to extract the users
password hash from incoming websocket messages. This hash could then be
cracked.

The bcrypt hash is sent in incoming websocket messages every time the user
object is needed by the application.

This vulnerability affects TelescopeJS installations below version 0.15.

A discussion about these issues can be found here:
https://github.com/TelescopeJS/Telescope/issues/838

The commits leading to the fix for this flaw can be found here:

https://github.com/TelescopeJS/Telescope/blob/dd6130637c00a8166cc4647153b441cb32b7ca61/lib/publications.js#L29-L31

If any more details are required, please let me know.

Thank you,
Shubham

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.