CVE-2024-51478: Yeswiki Auth Bypass Vulnerability

CVE-2024-51478 Overview

CVE-2024-51478 is a critical cryptographic vulnerability affecting YesWiki, an open-source wiki system written in PHP. Prior to version 4.4.5, the application uses a weak cryptographic algorithm combined with a hard-coded salt to hash password reset keys. This fundamental security flaw allows attackers to recover and exploit password reset tokens, enabling unauthorized password resets for any user account within the affected YesWiki installation.

Critical Impact

Attackers can recover password reset keys and take over any user account, including administrative accounts, without requiring authentication or user interaction.

Affected Products

• YesWiki versions prior to 4.4.5
• All YesWiki installations using the default password reset functionality
• Self-hosted YesWiki deployments with exposed password reset endpoints

Discovery Timeline

• 2024-10-31 - CVE-2024-51478 published to NVD
• 2025-05-09 - Last updated in NVD database

Technical Details for CVE-2024-51478

Vulnerability Analysis

This vulnerability stems from a fundamental cryptographic weakness classified under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm). The password reset mechanism in YesWiki prior to version 4.4.5 suffers from two critical implementation flaws that combine to create an exploitable weakness.

First, the application employs a weak cryptographic algorithm to generate password reset tokens. Second, and more critically, the salt value used in the hashing process is hard-coded directly into the application source code. Since the salt is static and publicly accessible (as YesWiki is open-source), attackers can reverse-engineer or predict the password reset keys generated by the system.

The network-accessible nature of this vulnerability means attackers can exploit it remotely without any prior authentication or privileges. No user interaction is required, making this a particularly dangerous flaw for internet-facing YesWiki installations.

Root Cause

The root cause is the combination of a weak cryptographic algorithm and a hard-coded salt value in the password reset key generation process. Hard-coded cryptographic secrets represent a severe security anti-pattern, as they cannot be changed per-installation and become publicly known once the source code is accessible. This eliminates the security benefit that salting is designed to provide, reducing the password reset token generation to a predictable, reversible process.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Initiating a password reset request for a target user account
2. Using knowledge of the hard-coded salt and weak algorithm to compute or predict the password reset key
3. Using the recovered reset key to complete the password reset process
4. Gaining full access to the target account, including administrative accounts

The vulnerability allows for complete account takeover with high impact to both confidentiality and integrity of the affected system. Administrative account compromise could lead to full wiki content manipulation, user data exposure, and potential server-side attacks depending on the deployment configuration.

Detection Methods for CVE-2024-51478

Indicators of Compromise

• Unusual volume of password reset requests across multiple user accounts
• Password reset completions for accounts where the legitimate user did not initiate the request
• Administrative account password changes without authorized user activity
• Access log entries showing password reset endpoint access from suspicious IP addresses
• Unexpected account lockouts or users reporting being unable to access their accounts

Detection Strategies

• Monitor password reset endpoint access patterns for anomalous behavior
• Implement alerting on successful password resets, particularly for privileged accounts
• Review web application logs for high-frequency reset token validation attempts
• Cross-reference password reset activity with user-reported incidents
• Deploy web application firewall rules to detect reset endpoint abuse

Monitoring Recommendations

• Enable comprehensive logging for all authentication-related endpoints
• Configure SIEM rules to alert on password reset anomalies
• Implement rate limiting and monitoring on the password reset functionality
• Establish baseline metrics for normal password reset activity to identify deviations

How to Mitigate CVE-2024-51478

Immediate Actions Required

• Upgrade YesWiki to version 4.4.5 or later immediately
• Audit all user accounts for unauthorized password changes, especially administrative accounts
• Force password resets for all users after upgrading to ensure any compromised accounts are secured
• Review access logs for signs of exploitation prior to patching

Patch Information

The YesWiki development team has addressed this vulnerability in version 4.4.5. The fix involves replacing the weak cryptographic algorithm and eliminating the hard-coded salt in favor of secure, randomized token generation. The security patches are available through the following commits:

• GitHub Commit b5a8f93
• GitHub Commit e128570

For complete details on the vulnerability and remediation, refer to the GitHub Security Advisory GHSA-4fvx-h823-38v3.

Workarounds

• Temporarily disable the password reset functionality if immediate patching is not possible
• Implement additional authentication requirements for password reset completion (e.g., security questions, admin approval)
• Restrict network access to the YesWiki installation to trusted IP ranges
• Enable additional monitoring and alerting on the password reset endpoints while awaiting patching
• Consider placing the application behind a WAF with strict rate limiting on authentication endpoints