Security: the superuser password of hypha.php is stored in plain text; options to improve password storage

Aperta
  • Qualcosa non va?
#642 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
1-2 giorni
Idoneità per principianti
53/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
php
Ambito
authentication, security

Direzione di ricerca

Start with hypha.php, especially the password declaration near line 10, the installer write near line 111, and the login check near line 454; then read system/core/crypto.php to see how password hashing is handled. The issue recommends hashing the superuser password, verifying it on login, and safely writing the value into PHP source. Done means existing installs can transition safely and new passwords are no longer stored in plain text.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Impact: Medium Level: Easy Type: Bug Value: Security

How Hypha stores passwords now

Password Where How
Member accounts data/hypha.xml, attribute password of <user> password_hash($password, PASSWORD_DEFAULT) (bcrypt with salt) in system/core/crypto.php. Accounts from older Hypha versions can still hold an unsalted MD5 hash, compared with ==. That part is #426, with PR #491.
Superuser of hypha.php (install and maintenance) hypha.php itself, line 10: $password = '...'; Plain text. The installer writes the posted value into the PHP source with preg_replace (line 111), and the login compares it with === (line 454).

So member passwords are hashed (not encrypted, which is right for passwords), apart from the legacy MD5 hashes of #426. The superuser password is not protected at all.

Why the superuser password matters

  • Anyone who gets a copy of hypha.php reads the password. Ways to get one: a backup, a .vorige or .bak copy in the web root, the builder of #413, a mistake in the web server configuration that serves PHP as text, or a container image or repository that contains the file.
  • People reuse passwords, so the password often opens other services as well.
  • The installer puts the posted value into PHP source without escaping. A ' in the password breaks hypha.php, and $1 or \1 in it is changed by preg_replace. Only someone already logged in to hypha.php can do this, but it turns a password field into PHP code.
  • === on a secret is not constant-time.

Options to improve

  1. Hash the superuser password. Store password_hash() output in hypha.php and check it with password_verify(). When $password is not a hash (an existing install), accept it once, then write the hash at that login, or ask for a new password. Write the value with var_export() instead of preg_replace, so no character can break the source. Effort: small. This option alone takes away most of the risk.
  2. Retire the legacy MD5 member hashes and rehash on login: #426 / PR #491.
  3. Use Argon2id where available. PASSWORD_ARGON2ID exists when PHP is built with libargon2 or libsodium (the official PHP images have it). Together with password_needs_rehash() (part of PR #491), hashes move over at the next login. Bcrypt with cost 12, the default from PHP 8.4, is also acceptable. This is a choice, not a must.
  4. Keep the hashes out of reach. Make sure data/ can never be downloaded (#427 / PR #494), and preferably support a data folder outside the web root. A hash that cannot be read cannot be attacked offline.
  5. Limit guessing of member and superuser passwords: #424 / PR #493 for members. hypha.php has no limit yet.
  6. Optional, larger: move the superuser credentials out of hypha.php into a file outside the web root, or into an environment variable (useful for containers). Or drop the separate superuser and let an administrator account of the site do maintenance.

Suggested order

Option 1 first: it is small, it closes the plain-text password, and it is not covered by any open issue. Then merge PR #491 and PR #494.

🤖 Generated with Claude Code

Lingua principale
JavaScript
Stelle
5
Fork
9
Merge medio
18h 49m
PR unite (30g)
13

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di PlanBCode/hypha

Tutte le issue di PlanBCode/hypha

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.