CVE-2022-24784: Discoverability of user password hash in Statamic CMS
Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a single character of a user's password hash using a specially crafted regular expression filter in the users endpoint of the REST API. Multiple such requests can eventually uncover the entire hash. The hash is not present in the response, however the presence or absence of a result confirms if the character is in the right position. The API has throttling enabled by default, making this a time intensive task. Both the REST API and the users endpoint need to be enabled, as they are disabled by default. The issue has been fixed in versions 3.2.39 and above, and 3.3.2 and above.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-24784?
CVE-2022-24784 is a vulnerability in Statamic CMS versions 3.2.39 and 3.3.2 that allows an attacker to uncover a user's password hash using a specially crafted regular expression filter.
How does CVE-2022-24784 work?
CVE-2022-24784 works by making multiple requests to the users endpoint of the REST API with a specially crafted regular expression filter in order to reveal the entire password hash.
What is the severity of CVE-2022-24784?
CVE-2022-24784 has a severity rating of medium with a value of 3.7.
How can I check if my Statamic CMS version is affected?
You can check if your Statamic CMS version is affected by CVE-2022-24784 by verifying if it is either version 3.2.39 or between version 3.3.0 and 3.3.2.
How do I fix CVE-2022-24784?
To fix CVE-2022-24784, you should update your Statamic CMS to a version higher than 3.3.2.