CodeIgniter Shield Password Shucking Vulnerability
CVE-2023-27580
What is CVE-2023-27580?
The CodeIgniter Shield, which serves as an authentication and authorization package for the CodeIgniter 4 PHP framework, has revealed a security flaw in its password storage mechanism. This vulnerability allows hashed passwords, particularly from versions v1.0.0-beta.3 and earlier, to be more susceptible to cracking than intended, using SHA-384 hashing without a salt. If an attacker gains access to both a user's hashed password and a publicly leaked hashed password, they could potentially reverse-engineer the original password. Users and developers using the affected versions are urged to upgrade to Shield v1.0.0-beta.4 or later and refresh all stored hashed passwords to reinforce security. No immediate workarounds are available for this issue.
Affected Version(s)
shield < 1.0.0-beta.4