Password_hash null byte bug in PHP <8.1.28/8.2.18/8.3.5
CVE-2024-3096 Published on April 29, 2024

PHP function password_verify can erroneously return true when argument contains NUL
In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

NVD

Vulnerability Analysis

CVE-2024-3096 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.


Products Associated with CVE-2024-3096

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-3096 are published in these products:

Canonical Ubuntu Linux
 
PHP
 
Debian Linux
 
Phpgroup Php
 

Affected Versions

PHP Group PHP: php_group php: php_group php: php_group php:

Exploit Probability

EPSS
1.07%
Percentile
77.44%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.