CVE-2023-38492 Kirby vulnerable to denial of service from unlimited password lengths
Attackers can cause denial of service by submitting excessively long passwords to the authentication endpoint, consuming server resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-38492?
CVE-2023-38492 is a medium-severity denial of service vulnerability in getkirby kirby, published on 27 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). The real-world impact of this vulnerability is limited, however we still recommend to update to one of the patch releases because they also fix more severe vulnerabilities.
Kirby's authentication endpoint did not limit the password length. This allowed attackers to provide a password with a length up to the server's maximum request body length. Validating that password against the user's actual password requires hashing the provided password, which requires more CPU and memory resources (and therefore processing time) the longer the provided password gets. This could be abused by an attacker to cause the website to become unresponsive or unavailable. Because Kirby comes with a built-in brute force protection, the impact of this vulnerability is limited to 10 failed logins from each IP address and 10 failed logins for each existing user per hour.
The problem has been patched in Kirby 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6. In all of the mentioned releases, the maintainers have added password length limits in the affected code so that passwords longer than 1000 bytes are immediately blocked, both when setting a password and when logging in.
Weakness: CWE-770
Which versions are affected by CVE-2023-38492?
10 open source packages ship an affected version, including getkirby/cms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
getkirby/cms Packagist | All versions | 3.5.8.3 |
getkirby/cms Packagist | All versions | 3.5.8.3 |
getkirby/cms Packagist | From 3.6.0 | 3.6.6.3 |
getkirby/cms Packagist | From 3.6.0 | 3.6.6.3 |
getkirby/cms Packagist | From 3.7.0 | 3.7.5.2 |
getkirby/cms Packagist | From 3.7.0 | 3.7.5.2 |
4 more packages
getkirby/cms Packagist | From 3.8.0 | 3.8.4.1 |
getkirby/cms Packagist | From 3.8.0 | 3.8.4.1 |
getkirby/cms Packagist | From 3.9.0 | 3.9.6 |
getkirby/cms Packagist | From 3.9.0 | 3.9.6 |
Products include Getkirby Kirby.
How do I fix CVE-2023-38492?
Upgrade getkirby/cms to a fixed version for your release line: 3.5.8.3, 3.6.6.3, 3.7.5.2 or 3.8.4.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-38492 being exploited?
There is no known exploitation of CVE-2023-38492 in the wild and no public exploit code.
Other vulnerabilities in getkirby kirby
- CVE-2024-26483 Kirby vulnerable to unrestricted file upload of user avatar images
- CVE-2024-41964 Insufficient permission checks in the language settings in Kirby CMS
- CVE-2026-34587 Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
- CVE-2021-29460 Cross-site scripting (XSS) from unsanitized uploaded SVG files
- CVE-2023-38489 Kirby vulnerable to Insufficient Session Expiration after a password change
Sources
Also known as GHSA-3v6j-v3qc-cxff.