CVE-2024-51478·PHP vulnerability

Affected versions

How to fix this CVE

YesWiki installations running versions prior to 4.4.5 are vulnerable to password reset key recovery due to weak cryptographic hashing with a hardcoded salt. Immediately upgrade YesWiki to version 4.4.5 or later to replace the vulnerable password reset mechanism with a cryptographically secure implementation. After upgrading, invalidate all existing password reset tokens and require administrators to issue fresh password resets for affected users.

sudo dnf update php

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST /wakka.php?wiki=PasswordReset with repeated token generation attempts or GET requests containing base64-encoded predictable reset tokens matching the pattern ^[a-f0-9]{32}$ derived from weak hash algorithms

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement rate limiting on password reset endpoints (/wakka.php?wiki=PasswordReset or similar) to block multiple reset attempts from the same IP within a short timeframe. Add WAF rules to detect and block requests containing suspicious password reset tokens with entropy patterns inconsistent with cryptographic randomness.

How to check if you are affected

1. Step 1: Check YesWiki version by inspecting the release file: grep -r "VERSION" /path/to/yeswiki/includes/ | grep -i version
2. Step 2: Search for password reset tokens in the YesWiki database: SELECT * FROM yeswiki_pages WHERE tag LIKE '%reset%' OR content LIKE '%token%' LIMIT 10;
3. Step 3: Review web server access logs for unusual password reset requests: grep -i "reset\|pwd\|password" /var/log/apache2/access.log | grep POST
4. Step 4: After upgrading to 4.4.5, verify the new cryptographic implementation is active by checking the commit hash in the installation: cd /path/to/yeswiki && git log --oneline | grep -i 'password\|hash\|crypto' | head -5

FAQ

Related PHP CVEs

References

• https://github.com/YesWiki/yeswiki/commit/b5a8f93b87720d5d5f033a4b3a131ce0fb621dbc
• https://github.com/YesWiki/yeswiki/commit/e1285709f6f6a2277bd0075acf369f33cefd78f7
• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-4fvx-h823-38v3