Observable Timing Discrepancy in answerdev/answer

CVE-2023-1538 is an observable timing discrepancy vulnerability in the answerdev/answer Q&A platform prior to version 1.0.6. The issue resides in the CAPTCHA verification logic, where the VerifyCaptcha function fails to delete the stored CAPTCHA after a failed verification attempt and returns differing error messages based on whether the CAPTCHA exists or is incorrect. This timing and response difference allows an attacker to infer whether a given key corresponds to a valid, pending CAPTCHA.

An attacker can exploit this by sending repeated CAPTCHA verification requests with the same key and different candidate CAPTCHA values. When the key is valid, the system first retrieves the stored CAPTCHA and then compares it, producing a distinct time and error pattern compared to when the key is invalid or expired. The official fix, introduced in commit 813ad0b [3], ensures the CAPTCHA is deleted after each verification attempt and logs errors consistently, eliminating the observable discrepancy.

The impact of this vulnerability is primarily information disclosure — an attacker could enumerate valid CAPTCHA keys, potentially bypassing the CAPTCHA protection. This could facilitate automated account creation, spam posting, or other abuse that the CAPTCHA was meant to prevent. The vulnerability does not directly lead to privilege escalation or remote code execution, but it undermines a security control.

Answer version 1.0.6, released on 2023-03-21, includes the patch for this issue [1]. Users running prior versions are advised to upgrade immediately. No workarounds have been published, and the vulnerability is not known to be exploited in the wild at the time of disclosure. The fix is available in the project's GitHub repository [2].