fix: remove hardcoded auth token and type-juggling bypass in legacy_auth.php#105
Open
hacktron-app-stg[bot] wants to merge 1 commit into
Open
fix: remove hardcoded auth token and type-juggling bypass in legacy_auth.php#105hacktron-app-stg[bot] wants to merge 1 commit into
hacktron-app-stg[bot] wants to merge 1 commit into
Conversation
The hardcoded "0e"-prefixed MD5 token combined with a loose == comparison allowed a PHP type-juggling authentication bypass (e.g. token=0). Source the expected token from the environment and compare with a strict type check plus constant-time hash_equals().
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vulnerability
legacy_auth.php:8embedded a hardcoded authentication token ("0e462097431906509019562988736854") and compared the client-suppliedtokenagainst it with a loose==comparison. Because the stored value is an "0e"-prefixed string, PHP's type juggling treats it as numeric zero, so a request likecurl -X POST -d "token=0" .../legacy_auth.phpsatisfies$_POST['token'] == $storedand sets$_SESSION['auth'] = true, bypassing authentication. The literal also functions as a real, committed credential.Fix
getenv('LEGACY_AUTH_TOKEN').==comparison with a strict, constant-time check:is_string(...)guard +hash_equals().This addresses the reported hardcoded-secret / type-juggling finding (VULN 1) with a minimal change. The other intentionally-vulnerable demo lines in the file were left untouched as they are outside this finding's scope.
Verification
Reviewed the data flow (
$_POST['token']→ loose==→$_SESSION['auth']) to confirm the bypass, then confirmed the new code path can no longer be satisfied by type-juggled input and no longer contains an embedded credential.php -lwas unavailable in the sandbox (PHP not installed), so linting could not be run; the edit is a straightforward syntactic replacement.Automated fix by Hacktron for finding: https://staging.hacktron.ai/testestesttest/findings/169b8815-9ed0-4dd8-900e-99b03b81d881