MyBB Password Reset Weak Random Numbers Vulnerability
7 Sep. 2010
Summary
Usage of weak random number generation in password reset functionality allows predicting the password reset token and the randomly generated password, which results in account takeover.
Vulnerable Systems:
* MyBB versions 1.4.11 and earlier
Immune Systems:
* MyBB version 1.4.12
During evaluation of various password reset implementations it was discovered that MyBB uses weak random numbers when generating the password reset token and randomly generated passwords.
A malicious user can takeover arbitrary accounts if PHP processes are reused by the webserver. The most common PHP installation: mod_php with activated keep-alive request is therefore vulnerable.
In various places MyBB seeds the random number generator with the mt_srand() function.
Code like this will seed the random number generator with only one million different seed values. In addition to that the first generated random number will be leaked to the user in form of the post hash. Because the user knows his 'uid' it is easy to find the seed used by just bruteforcing the one million possibilities.
A normal desktop PC is able to perform this attack in less than a second.
Because the state of the random number generator is shared by requests handled by the same PHP process a password reset triggered afterwards will therefore use a state known by the attacker.
The password reset will first create a random password reset token that is sent to the user. If this token is used the second step of the password reset will generate a new random password. Both random strings are generated by the following function.
The problem with this code is that is uses mt_rand() to generate the random strings and the state of the mt_rand() number generator is known to the remote attacker. He is therefore able to predict both the genersted password reset token and also the new password. This allows taking over arbitrary accounts.
Disclosure Timeline:
31. March 2010 - Notified the MyBB devs via security contact form
13. April 2010 - MyBB developers released MyBB 1.4.12
13. April 2010 - Public Disclosure
