x/vulndb: potential Go vuln in github.com/mojocn/base64Captcha: CVE-2023-45292

[cangkuai]

Acknowledgement

• The maintainer(s) of the affected project have already been made aware of this vulnerability.

Description

This is a Module that generates website Captcha. I found that some special values can bypass Captcha verification.
When using store.Verify() to verify whether the Captcha is correct, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.
Sample code：

package main

import (
	"fmt"
	"strconv"
	"testing"

	"github.com/mojocn/base64Captcha"
)

func TestCat(t *testing.T) {
	var store = base64Captcha.DefaultMemStore
	fmt.Println(strconv.FormatBool(store.Verify("dsad", "", true)))
}

Reproduction screenshot


(I blurred my name in the picture above.)

Affected Modules, Packages, Versions and Symbols

Module: github.com/mojocn/base64Captcha
Package: github.com/mojocn/base64Captcha
Versions:
  - Introduced: 1.3.5
Symbols:
  - store.Verify()

CVE/GHSA ID

No response

Fix Commit or Pull Request

No response

References

mojocn/base64Captcha#120

Additional information

I contacted the author via email and issue, but after 6 days there was still no feedback from the author.

[cangkuai]

Is it because my report is not detailed enough or is it difficult to understand?

[tatianab]

Hello, thanks for your report. We are planning create an entry in the Go vulnerability database for this issue. It should be published today or tomorrow.

[gopherbot]

Change https://go.dev/cl/548060 mentions this issue: data/reports: add GO-2023-2386.yaml

[cangkuai]

Thank you very much for getting the CVE number so quickly.

[cangkuai]

This vulnerability is fixed in version 1.3.6
mojocn/base64Captcha@9b11012
mojocn/base64Captcha@5ab86bd

[gopherbot]

Change https://go.dev/cl/548755 mentions this issue: data/reports: update GO-2023-2386.yaml

[tatianab]

Thanks again for your report. This has been published (including the fix you referenced) as GO-2023-2386 and CVE-2023-45292

[gopherbot]

Change https://go.dev/cl/549595 mentions this issue: data/reports: update GO-2023-2386.yaml