Discoverability of user password hash in Statamic CMS

Vulnerability

In Statamic CMS versions before 3.2.39 and 3.3.2, the users endpoint of the REST API allows filtering by regular expressions. An attacker can craft a regex that matches a single character of a user's password hash at a specific position. By observing whether results are returned, the attacker can confirm the character. This uses a timing side-channel via presence/absence of results. The vulnerability exists only if both the REST API and the users endpoint are enabled (disabled by default). [1]

Exploitation

The attacker needs network access to the API. No authentication is required if the users endpoint is publicly accessible. The attacker sends multiple requests, each testing a character position with a regex like ^a to confirm if the hash starts with 'a'. Due to default API throttling, this is time-intensive. The attacker must repeat for each character until the entire hash is revealed. [1]

Impact

Successful exploitation leads to full disclosure of the user's password hash. While the hash itself is not directly usable, it can be used in offline brute-force attacks. However, the impact is limited by the time required due to throttling and the need for the API to be enabled. [1]

Mitigation

The issue is fixed in Statamic versions 3.2.39 and 3.3.2 [1]. Administrators should upgrade to these versions or later. If upgrade is not immediate, disabling the REST API or the users endpoint prevents exploitation, as they are disabled by default. No other workarounds have been published. [2][3][4]