CVE-2023-33243
HighCVSS 8.1Exploitation Probability (EPSS)
Very high risk90th percentile - higher than 90% of all known CVEs
Summary
RedTeam Pentesting discovered that the web interface of STARFACE and its REST API allow authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application's database is generally considered best practice, this becomes ineffective in this case.
Risk Assessment
Allowing authentication using the password hash poses a risk that attackers could gain access to user accounts if the hash is compromised. This undermines data security and could lead to unauthorized access.
Recommendation
It is recommended that STARFACE implement additional security measures to prevent authentication using password hashes. Consideration should also be given to implementing more advanced password protection methods, such as salting.
Original NVD description (English source)
RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application's database generally has become best practice to protect users' passwords in case of a database compromise, this is rendered ineffective when allowing to authenticate using the password hash.