| शीर्षक | Public Knowledge Project ojs, pkp-lib 3.5.0 Predictable API Key Generation |
|---|
| विवरण | When a user generates an API key via their profile settings, the key is
computed as:
$user->setData('apiKey', sha1(time()));
sha1(time()) produces a 40-character hex string seeded by the current Unix
timestamp — a sequential integer with at most ~31.4 bits of entropy over a
30-day window (2,592,000 candidates). An attacker who knows the approximate
date the key was generated can recover it through brute-force in under 2
seconds of SHA1 computation, then construct a valid HS256 JWT and authenticate
against the REST API as the target user without their password. |
|---|
| स्रोत | ⚠️ https://github.com/pkp/pkp-lib/issues/12951 |
|---|
| उपयोगकर्ता | Razielx64 (UID 97461) |
|---|
| सबमिशन | 26/06/2026 03:00 PM (2 महीनों पहले) |
|---|
| संयम | 14/08/2026 09:48 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 390119 [pkp pkp-lib 3.3.0/3.4.0/3.5.0 API Key Generation APIProfileForm.php setData apiKey कमजोर एन्क्रिप्शन] |
|---|
| अंक | 20 |
|---|