Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses

[Fabian Bäumer <fabian.baeumer () rub de>]

> I don't think that a seeded PRF (with a per-server seed) would meet
> the requirements here.
I think you are right. When I wrote my response yesterday I wasn't fully 
aware how Gravatar is supposed to be used. I always thought of Gravatar 
as a service to generate unique avatar images.

Now, this leaves me with a few observations:

1. The 'should be taken' from Gravatar's documentation should be 'must
   be taken' to ensure consistent user hashes (therefore using MD5 in
   the first place rendered Gravatar useless if Gravatar doesn't match
   against MD5 hashes as well).
2. The information leakage with Gravatar is in-spec. Fixing the
   information leakage would be possible but requires changes on
   Gravatar's side by implementing a symmetric cipher instead of a hash
   (as suggested; a hash wouldn't be tractable any more because
   Gravatar would need to hash every user's email address with every
   registered seed when using seeded PRF). Prior hashing wouldn't even
   be required given that both sides - Gravatar and the site itself -
   have access to the user's email address anyway.
3. It may be advisable to not use Gravatar as the default (not sure if
   this is the case here). Instead, let user's choose it and let them
   know about the potential information leakage.
4. The fix does not fix what it tries to fix.
5. Assigning a CVE for an in-spec information leakage seems not useful
   to me. Otherwise, every single product using Gravatar would be
   affected by this.

M. Sc. Fabian Bäumer

Chair for Network and Data Security
Ruhr University Bochum
Universitätsstr. 150, Building MC 4/145
44780 Bochum
Germany

Am 27.09.2024 um 14:25 schrieb Alexander Patrakov:
> On Thu, Sep 26, 2024 at 5:19 AM Demi Marie Obenour
> <demi () invisiblethingslab com> wrote:
> > On Wed, Sep 25, 2024 at 06:28:16AM +0000, Enxin Xie wrote:
> > > Severity: low
> > >
> > > Affected versions:
> > >
> > > - Apache Answer through 1.3.5
> > >
> > > Description:
> > >
> > > Inadequate Encryption Strength vulnerability in Apache Answer.
> > >
> > > This issue affects Apache Answer: through 1.3.5.
> > >
> > > Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The 
> > > official recommendation is to use SHA256 instead.
> > > Users are recommended to upgrade to version 1.4.0, which fixes the issue.
> > >
> > > Credit:
> > >
> > > 张岳熙 (reporter)
> > >
> > > References:
> > >
> > > https://answer.incubator.apache.org
> > > https://www.cve.org/CVERecord?id=CVE-2024-40761
> > What is the specific property of SHA256 required here?  Email addresses
> > have low entropy and I suspect they can be easily brute-forced, so
> > leaking the SHA256 has is still bad.  Instead, I would use a seeded PRF
> > with a seed only known to the server, ensuring that the resulting value
> > does not leak any information about the email.
> > --
> > Sincerely,
> > Demi Marie Obenour (she/her/hers)
> > Invisible Things Lab
> I don't think that a seeded PRF (with a per-server seed) would meet
> the requirements here. The problem is that Gravatar would have no way
> of understanding which email is in question. Indeed, that would
> require storing all emails hashed with all registered server seeds.
>
> What would work is an email hash encrypted symmetrically with a
> per-server key. Then Gravatar (who also knows this key) would decrypt
> the email hash and look up the avatar image.
>
> Note that all of the above talks about a hypothetical improved version
> of Gravatar, not what we have right now.

Attachment: smime.p7s
Description: Kryptografische S/MIME-Signatur