Re: CVE request - simple-php-captcha - captcha bypass vulnerability

[Solar Designer <solar () openwall com>]

On Sun, Aug 09, 2015 at 03:50:10PM -0400, Fran??ois Labr??che wrote:
> We found a captcha bypass vulnerability in an open source captcha 
> software, made by Cory LaViska for A Beautiful Site. Here is the github 
> repository: https://github.com/claviska/simple-php-captcha.
>
> We opened an issue on github 
> <https://github.com/claviska/simple-php-captcha/issues/16>, and the 
> vulnerability has been fixed. They never did any release so we don't 
> think the fix will be released in any form. Simply advising users to 
> update to git master's should suffice.
>
> The simple-php-captcha.php file had a vulnerability enabling a client to 
> generate the captcha response automatically, effectively bypassing the 
> captcha.
>
> Since the microtime() function was used both in the initial seed for the 
> captcha and in the captcha url path sent to the client, it was possible 
> to generate the captcha result automatically by running the same code 
> client-side.

And you think removing the srand(microtime() * 100) fixes this?  Well,
it does appear to fix the most straightforward and easiest attack, and
captchas are bypassable in general, but does this raise the bar high
enough for the "fixed" version not to be CVE-worthy?  Or are you going
to be requesting a second CVE ID for it then?

The "fixed" code relies on PHP's automatic seeding for rand() (which is
typically dependent on system time anyway, adding only a process id to
the mix), and, what's probably worse, it uses rand() so many times that
it leaks its tiny internal state via properties of the captcha that are
easy for a computer to analyze.  While figuring out the captcha text
might require OCR, figuring out the text length, font size, x and y
position, and colors is easier.  OCR isn't rocket science, but it's the
intended level of "security" of this captcha, while being able to infer
the text through even easier analysis of "metadata" is a captcha bypass,
somewhat similar to (but moderately trickier than) your initial finding.

Alexander