CodeIgniter Shield Password Shucking Vulnerability

CVE-2023-27580

What is CVE-2023-27580?

The CodeIgniter Shield, which serves as an authentication and authorization package for the CodeIgniter 4 PHP framework, has revealed a security flaw in its password storage mechanism. This vulnerability allows hashed passwords, particularly from versions v1.0.0-beta.3 and earlier, to be more susceptible to cracking than intended, using SHA-384 hashing without a salt. If an attacker gains access to both a user's hashed password and a publicly leaked hashed password, they could potentially reverse-engineer the original password. Users and developers using the affected versions are urged to upgrade to Shield v1.0.0-beta.4 or later and refresh all stored hashed passwords to reinforce security. No immediate workarounds are available for this issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References