CVE-2023-40021 Timing Attack Reveals CSRF Tokens in oppia
Attackers can brute-force CSRF tokens via timing attacks to perform unauthorized actions on behalf of logged-in users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-40021?
CVE-2023-40021 is a medium-severity vulnerability in oppia, published on 16 Aug 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Oppia is an online learning platform. When comparing a received CSRF token against the expected token, Oppia uses the string equality operator (`==`), which is not safe against timing attacks. By repeatedly submitting invalid tokens, an attacker can brute-force the expected CSRF token character by character. Once they have recovered the token, they can then submit a forged request on behalf of a logged-in user and execute privileged actions on that user's behalf. In particular the function to validate received CSRF tokens is at `oppia.core.controllers.base.CsrfTokenManager.is_csrf_token_valid`. An attacker who can lure a logged-in Oppia user to a malicious website can perform any change on Oppia that the user is authorized to do, including changing profile information; creating, deleting, and changing explorations; etc. Note that the attacker cannot change a user's login credentials. An attack would need to complete within 1 second because every second, the time used in computing the token changes. This issue has been addressed in commit `b89bf80837` which has been included in release `3.3.2-hotfix-2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Which versions are affected by CVE-2023-40021?
It affects 1 product.
Products include Oppia Oppia.
How do I fix CVE-2023-40021?
No fix has been published for CVE-2023-40021 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-40021 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-40021 exists.
Other vulnerabilities in oppia
Sources
Also known as GHSA-49jp-pjc3-2532.