Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames
The advisory, in context
Summary
There is a Proof of Concept which is able to enumerate the usernames of administrator users. This was possible by performing a timing attack.
Details
The faulty code exists in src/Core/Framework/Api/OAuth/UserRepository.php:
public function getUserEntityByUserCredentials(
string $username,
#[\SensitiveParameter]
string $password,
string $grantType,
ClientEntityInterface $clientEntity
): ?UserEntityInterface {
if ($this->loginConfigService->getConfig()?->useDefault === false) {
// never allow login via password if the default login is disabled (e.g. using SSO only)
return null;
}
$builder = $this->connection->createQueryBuilder();
$user = $builder->select('user.id', 'user.password')
->from('user')
->where('username = :username')
->setParameter('username', $username)
->fetchAssociative();
// PATH 1: EARLY RETURN WHEN USERNAME IS NOT FOUND
if (!$user) {
return null;
}
// PATH 2: VERIFY PASSWORD IF USER IS FOUND
if (!password_verify($password, (string) $user['password'])) {
return null;
}
return new User(Uuid::fromBytesToHex($user['id']));
}
Subroutine getUserEntityByUserCredentials() is called when an auth request is send to api/oauth/token. If the given username is not found an early return is done (PATH 1). Only if the user is found we verify the password using password_verify.
PHP method password_verify by default uses hashing algorithm Argon2id which by design is intentionally 'slow' by introducing a timing cost to an attempt to bruteforce hashes more costly.
Since password_verify has a notable executable time, PATH 2 where an user is found and verified will be slower on average then PATH 1 where we do an early return for non-existing users.
Proposed fix
Before doing the early return, password_verify a dummy hash.
Impact
- More targeted dictionary/bruteforce attacks.
- Spear phishing / eases social engineering.
- Credential stuffing from other data leaks.
Authors
Niel Duysters (@NielDuysters) and Thomas Brankaer (@tbrankaer)
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 6.7.0.0 before 6.7.10.1
Fixed in 6.7.10.1
26 explicitly affected versions
v6.7.0.0, v6.7.0.1, v6.7.1.0, v6.7.1.1, v6.7.1.2, v6.7.10.0, v6.7.2.0, v6.7.2.1, v6.7.2.2, v6.7.3.0, v6.7.3.1, v6.7.4.0, v6.7.4.1, v6.7.4.2, v6.7.5.0, v6.7.5.1, v6.7.6.0, v6.7.6.1, v6.7.6.2, v6.7.7.0, v6.7.7.1, v6.7.8.0, v6.7.8.1, v6.7.8.2, v6.7.9.0, v6.7.9.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "6.7.0.0"
},
{
"fixed": "6.7.10.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v6.7.0.0",
"v6.7.0.1",
"v6.7.1.0",
"v6.7.1.1",
"v6.7.1.2",
"v6.7.10.0",
"v6.7.2.0",
"v6.7.2.1",
"v6.7.2.2",
"v6.7.3.0",
"v6.7.3.1",
"v6.7.4.0",
"v6.7.4.1",
"v6.7.4.2",
"v6.7.5.0",
"v6.7.5.1",
"v6.7.6.0",
"v6.7.6.1",
"v6.7.6.2",
"v6.7.7.0",
"v6.7.7.1",
"v6.7.8.0",
"v6.7.8.1",
"v6.7.8.2",
"v6.7.9.0",
"v6.7.9.1"
]
}Earlier releases before 6.6.10.18
Fixed in 6.6.10.18
166 explicitly affected versions
6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.18.1, 6.4.19.0, 6.4.2.0, 6.4.2.1, 6.4.20.0, 6.4.20.1, 6.4.20.2, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, 6.5.0.0, 6.5.0.0-rc1, 6.5.0.0-rc2, 6.5.0.0-rc3, 6.5.0.0-rc4, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3, v6.5.1.0, v6.5.1.1, v6.5.2.0, v6.5.2.1, v6.5.3.0, v6.5.3.1, v6.5.3.2, v6.5.3.3, v6.5.4.0, v6.5.4.1, v6.5.5.0, v6.5.5.1, v6.5.5.2, v6.5.6.0, v6.5.6.1, v6.5.7.0, v6.5.7.1, v6.5.7.2, v6.5.7.3, v6.5.7.4, v6.5.8.0, v6.5.8.1, v6.5.8.10, v6.5.8.11, v6.5.8.12, v6.5.8.13, v6.5.8.14, v6.5.8.15, v6.5.8.16, v6.5.8.17, v6.5.8.18, v6.5.8.19, v6.5.8.2, v6.5.8.3, v6.5.8.4, v6.5.8.5, v6.5.8.6, v6.5.8.7, v6.5.8.8, v6.5.8.9, v6.6.0.0, v6.6.0.0-rc1, v6.6.0.0-rc2, v6.6.0.0-rc3, v6.6.0.0-rc4, v6.6.0.0-rc5, v6.6.0.0-rc6, v6.6.0.0-rc7, v6.6.0.1, v6.6.0.2, v6.6.0.3, v6.6.1.0, v6.6.1.1, v6.6.1.2, v6.6.10.0, v6.6.10.1, v6.6.10.10, v6.6.10.11, v6.6.10.12, v6.6.10.13, v6.6.10.14, v6.6.10.15, v6.6.10.16, v6.6.10.17, v6.6.10.2, v6.6.10.3, v6.6.10.4, v6.6.10.5, v6.6.10.6, v6.6.10.7, v6.6.10.8, v6.6.10.9, v6.6.2.0, v6.6.3.0, v6.6.3.1, v6.6.4.0, v6.6.4.1, v6.6.5.0, v6.6.5.1, v6.6.6.0, v6.6.6.1, v6.6.7.0, v6.6.7.1, v6.6.8.0, v6.6.8.1, v6.6.8.2, v6.6.9.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.6.10.18"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"6.3.0.0",
"6.3.0.1",
"6.3.0.2",
"6.3.1.0",
"6.3.1.1",
"6.3.2.0",
"6.3.2.1",
"6.3.3.0",
"6.3.3.1",
"6.3.4.0",
"6.3.4.1",
"6.3.5.0",
"6.3.5.1",
"6.3.5.2",
"6.3.5.3",
"6.3.5.4",
"6.4.0.0",
"6.4.0.0-RC1",
"6.4.1.0",
"6.4.1.1",
"6.4.1.2",
"6.4.10.0",
"6.4.10.1",
"6.4.11.0",
"6.4.11.1",
"6.4.12.0",
"6.4.13.0",
"6.4.14.0",
"6.4.15.0",
"6.4.15.1",
"6.4.15.2",
"6.4.16.0",
"6.4.16.1",
"6.4.17.0",
"6.4.17.1",
"6.4.17.2",
"6.4.18.0",
"6.4.18.1",
"6.4.19.0",
"6.4.2.0",
"6.4.2.1",
"6.4.20.0",
"6.4.20.1",
"6.4.20.2",
"6.4.3.0",
"6.4.3.1",
"6.4.4.0",
"6.4.4.1",
"6.4.5.0",
"6.4.5.1",
"6.4.6.0",
"6.4.6.1",
"6.4.7.0",
"6.4.8.0",
"6.4.8.1",
"6.4.8.2",
"6.4.9.0",
"6.5.0.0",
"6.5.0.0-rc1",
"6.5.0.0-rc2",
"6.5.0.0-rc3",
"6.5.0.0-rc4",
"v6.0.0+ea2",
"v6.1.0",
"v6.1.0-rc1",
"v6.1.0-rc2",
"v6.1.0-rc3",
"v6.1.0-rc4",
"v6.1.1",
"v6.1.2",
"v6.1.3",
"v6.1.4",
"v6.1.5",
"v6.1.6",
"v6.2.0",
"v6.2.0-RC1",
"v6.2.1",
"v6.2.2",
"v6.2.3",
"v6.5.1.0",
"v6.5.1.1",
"v6.5.2.0",
"v6.5.2.1",
"v6.5.3.0",
"v6.5.3.1",
"v6.5.3.2",
"v6.5.3.3",
"v6.5.4.0",
"v6.5.4.1",
"v6.5.5.0",
"v6.5.5.1",
"v6.5.5.2",
"v6.5.6.0",
"v6.5.6.1",
"v6.5.7.0",
"v6.5.7.1",
"v6.5.7.2",
"v6.5.7.3",
"v6.5.7.4",
"v6.5.8.0",
"v6.5.8.1",
"v6.5.8.10",
"v6.5.8.11",
"v6.5.8.12",
"v6.5.8.13",
"v6.5.8.14",
"v6.5.8.15",
"v6.5.8.16",
"v6.5.8.17",
"v6.5.8.18",
"v6.5.8.19",
"v6.5.8.2",
"v6.5.8.3",
"v6.5.8.4",
"v6.5.8.5",
"v6.5.8.6",
"v6.5.8.7",
"v6.5.8.8",
"v6.5.8.9",
"v6.6.0.0",
"v6.6.0.0-rc1",
"v6.6.0.0-rc2",
"v6.6.0.0-rc3",
"v6.6.0.0-rc4",
"v6.6.0.0-rc5",
"v6.6.0.0-rc6",
"v6.6.0.0-rc7",
"v6.6.0.1",
"v6.6.0.2",
"v6.6.0.3",
"v6.6.1.0",
"v6.6.1.1",
"v6.6.1.2",
"v6.6.10.0",
"v6.6.10.1",
"v6.6.10.10",
"v6.6.10.11",
"v6.6.10.12",
"v6.6.10.13",
"v6.6.10.14",
"v6.6.10.15",
"v6.6.10.16",
"v6.6.10.17",
"v6.6.10.2",
"v6.6.10.3",
"v6.6.10.4",
"v6.6.10.5",
"v6.6.10.6",
"v6.6.10.7",
"v6.6.10.8",
"v6.6.10.9",
"v6.6.2.0",
"v6.6.3.0",
"v6.6.3.1",
"v6.6.4.0",
"v6.6.4.1",
"v6.6.5.0",
"v6.6.5.1",
"v6.6.6.0",
"v6.6.6.1",
"v6.6.7.0",
"v6.6.7.1",
"v6.6.8.0",
"v6.6.8.1",
"v6.6.8.2",
"v6.6.9.0"
]
}From 6.7.0.0 before 6.7.10.1
Fixed in 6.7.10.1
26 explicitly affected versions
v6.7.0.0, v6.7.0.1, v6.7.1.0, v6.7.1.1, v6.7.1.2, v6.7.10.0, v6.7.2.0, v6.7.2.1, v6.7.2.2, v6.7.3.0, v6.7.3.1, v6.7.4.0, v6.7.4.1, v6.7.4.2, v6.7.5.0, v6.7.5.1, v6.7.6.0, v6.7.6.1, v6.7.6.2, v6.7.7.0, v6.7.7.1, v6.7.8.0, v6.7.8.1, v6.7.8.2, v6.7.9.0, v6.7.9.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "6.7.0.0"
},
{
"fixed": "6.7.10.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v6.7.0.0",
"v6.7.0.1",
"v6.7.1.0",
"v6.7.1.1",
"v6.7.1.2",
"v6.7.10.0",
"v6.7.2.0",
"v6.7.2.1",
"v6.7.2.2",
"v6.7.3.0",
"v6.7.3.1",
"v6.7.4.0",
"v6.7.4.1",
"v6.7.4.2",
"v6.7.5.0",
"v6.7.5.1",
"v6.7.6.0",
"v6.7.6.1",
"v6.7.6.2",
"v6.7.7.0",
"v6.7.7.1",
"v6.7.8.0",
"v6.7.8.1",
"v6.7.8.2",
"v6.7.9.0",
"v6.7.9.1"
]
}Earlier releases before 6.6.10.18
Fixed in 6.6.10.18
166 explicitly affected versions
6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.18.1, 6.4.19.0, 6.4.2.0, 6.4.2.1, 6.4.20.0, 6.4.20.1, 6.4.20.2, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, 6.5.0.0, 6.5.0.0-rc1, 6.5.0.0-rc2, 6.5.0.0-rc3, 6.5.0.0-rc4, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3, v6.5.1.0, v6.5.1.1, v6.5.2.0, v6.5.2.1, v6.5.3.0, v6.5.3.1, v6.5.3.2, v6.5.3.3, v6.5.4.0, v6.5.4.1, v6.5.5.0, v6.5.5.1, v6.5.5.2, v6.5.6.0, v6.5.6.1, v6.5.7.0, v6.5.7.1, v6.5.7.2, v6.5.7.3, v6.5.7.4, v6.5.8.0, v6.5.8.1, v6.5.8.10, v6.5.8.11, v6.5.8.12, v6.5.8.13, v6.5.8.14, v6.5.8.15, v6.5.8.16, v6.5.8.17, v6.5.8.18, v6.5.8.19, v6.5.8.2, v6.5.8.3, v6.5.8.4, v6.5.8.5, v6.5.8.6, v6.5.8.7, v6.5.8.8, v6.5.8.9, v6.6.0.0, v6.6.0.0-rc1, v6.6.0.0-rc2, v6.6.0.0-rc3, v6.6.0.0-rc4, v6.6.0.0-rc5, v6.6.0.0-rc6, v6.6.0.0-rc7, v6.6.0.1, v6.6.0.2, v6.6.0.3, v6.6.1.0, v6.6.1.1, v6.6.1.2, v6.6.10.0, v6.6.10.1, v6.6.10.10, v6.6.10.11, v6.6.10.12, v6.6.10.13, v6.6.10.14, v6.6.10.15, v6.6.10.16, v6.6.10.17, v6.6.10.2, v6.6.10.3, v6.6.10.4, v6.6.10.5, v6.6.10.6, v6.6.10.7, v6.6.10.8, v6.6.10.9, v6.6.2.0, v6.6.3.0, v6.6.3.1, v6.6.4.0, v6.6.4.1, v6.6.5.0, v6.6.5.1, v6.6.6.0, v6.6.6.1, v6.6.7.0, v6.6.7.1, v6.6.8.0, v6.6.8.1, v6.6.8.2, v6.6.9.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.6.10.18"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"6.3.0.0",
"6.3.0.1",
"6.3.0.2",
"6.3.1.0",
"6.3.1.1",
"6.3.2.0",
"6.3.2.1",
"6.3.3.0",
"6.3.3.1",
"6.3.4.0",
"6.3.4.1",
"6.3.5.0",
"6.3.5.1",
"6.3.5.2",
"6.3.5.3",
"6.3.5.4",
"6.4.0.0",
"6.4.0.0-RC1",
"6.4.1.0",
"6.4.1.1",
"6.4.1.2",
"6.4.10.0",
"6.4.10.1",
"6.4.11.0",
"6.4.11.1",
"6.4.12.0",
"6.4.13.0",
"6.4.14.0",
"6.4.15.0",
"6.4.15.1",
"6.4.15.2",
"6.4.16.0",
"6.4.16.1",
"6.4.17.0",
"6.4.17.1",
"6.4.17.2",
"6.4.18.0",
"6.4.18.1",
"6.4.19.0",
"6.4.2.0",
"6.4.2.1",
"6.4.20.0",
"6.4.20.1",
"6.4.20.2",
"6.4.3.0",
"6.4.3.1",
"6.4.4.0",
"6.4.4.1",
"6.4.5.0",
"6.4.5.1",
"6.4.6.0",
"6.4.6.1",
"6.4.7.0",
"6.4.8.0",
"6.4.8.1",
"6.4.8.2",
"6.4.9.0",
"6.5.0.0",
"6.5.0.0-rc1",
"6.5.0.0-rc2",
"6.5.0.0-rc3",
"6.5.0.0-rc4",
"v6.0.0+ea2",
"v6.1.0",
"v6.1.0-rc1",
"v6.1.0-rc2",
"v6.1.0-rc3",
"v6.1.0-rc4",
"v6.1.1",
"v6.1.2",
"v6.1.3",
"v6.1.4",
"v6.1.5",
"v6.1.6",
"v6.2.0",
"v6.2.0-RC1",
"v6.2.1",
"v6.2.2",
"v6.2.3",
"v6.5.1.0",
"v6.5.1.1",
"v6.5.2.0",
"v6.5.2.1",
"v6.5.3.0",
"v6.5.3.1",
"v6.5.3.2",
"v6.5.3.3",
"v6.5.4.0",
"v6.5.4.1",
"v6.5.5.0",
"v6.5.5.1",
"v6.5.5.2",
"v6.5.6.0",
"v6.5.6.1",
"v6.5.7.0",
"v6.5.7.1",
"v6.5.7.2",
"v6.5.7.3",
"v6.5.7.4",
"v6.5.8.0",
"v6.5.8.1",
"v6.5.8.10",
"v6.5.8.11",
"v6.5.8.12",
"v6.5.8.13",
"v6.5.8.14",
"v6.5.8.15",
"v6.5.8.16",
"v6.5.8.17",
"v6.5.8.18",
"v6.5.8.19",
"v6.5.8.2",
"v6.5.8.3",
"v6.5.8.4",
"v6.5.8.5",
"v6.5.8.6",
"v6.5.8.7",
"v6.5.8.8",
"v6.5.8.9",
"v6.6.0.0",
"v6.6.0.0-rc1",
"v6.6.0.0-rc2",
"v6.6.0.0-rc3",
"v6.6.0.0-rc4",
"v6.6.0.0-rc5",
"v6.6.0.0-rc6",
"v6.6.0.0-rc7",
"v6.6.0.1",
"v6.6.0.2",
"v6.6.0.3",
"v6.6.1.0",
"v6.6.1.1",
"v6.6.1.2",
"v6.6.10.0",
"v6.6.10.1",
"v6.6.10.10",
"v6.6.10.11",
"v6.6.10.12",
"v6.6.10.13",
"v6.6.10.14",
"v6.6.10.15",
"v6.6.10.16",
"v6.6.10.17",
"v6.6.10.2",
"v6.6.10.3",
"v6.6.10.4",
"v6.6.10.5",
"v6.6.10.6",
"v6.6.10.7",
"v6.6.10.8",
"v6.6.10.9",
"v6.6.2.0",
"v6.6.3.0",
"v6.6.3.1",
"v6.6.4.0",
"v6.6.4.1",
"v6.6.5.0",
"v6.6.5.1",
"v6.6.6.0",
"v6.6.6.1",
"v6.6.7.0",
"v6.6.7.1",
"v6.6.8.0",
"v6.6.8.1",
"v6.6.8.2",
"v6.6.9.0"
]
}