MeterSphere up to 2.9.1 Password Length checkUserPassword allocation of resources

Summaryinfo

A vulnerability, which was classified as problematic, was found in MeterSphere up to 2.9.1. This affects the function checkUserPassword of the component Password Length Handler. Executing a manipulation can lead to allocation of resources. This vulnerability is registered as CVE-2023-32699. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in MeterSphere up to 2.9.1 and classified as problematic. This vulnerability affects the function checkUserPassword of the component Password Length Handler. The manipulation with an unknown input leads to a allocation of resources vulnerability. The CWE definition for the vulnerability is CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. As an impact it is known to affect availability. CVE summarizes:

MeterSphere is an open source continuous testing platform. Version 2.9.1 and prior are vulnerable to denial of service. ?The `checkUserPassword` method is used to check whether the password provided by the user matches the password saved in the database, and the `CodingUtil.md5` method is used to encrypt the original password with MD5 to ensure that the password will not be saved in plain text when it is stored. If a user submits a very long password when logging in, the system will be forced to execute the long password MD5 encryption process, causing the server CPU and memory to be exhausted, thereby causing a denial of service attack on the server. This issue is fixed in version 2.10.0-lts with a maximum password length.

The weakness was published 05/30/2023 as GHSA-qffq-8gf8-mhq7. The advisory is shared for download at github.com. This vulnerability was named CVE-2023-32699 since 05/11/2023. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 2.10.0-lts eliminates this vulnerability. Applying the patch c59e381d368990214813085a1a4877c5ef865411 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• MeterSphere

Version

• 2.9.0
• 2.9.1

License

• open-source

Website

• Product: https://github.com/metersphere/metersphere/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion