Description
JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using precomputed tables or GPU brute force.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
juggleim JuggleIM
Default version status: unaffected
0 to ≤ 1.8.16affected
pkg:github/juggleim/im-serverReferences
- https://hackmd.io/@hieuPenguinnn/juggleim-im-server-default-admin-credential ↗
- https://github.com/juggleim/imserver-console/blob/v1.0.10/services/accountservice.go#L95 ↗
- https://github.com/juggleim/im-server/blob/v1.8.16/sql/imserver.sql#L3-L15 ↗
- https://github.com/juggleim/im-server ↗
- https://www.vulncheck.com/advisories/juggleim-im-server-through-1.8.16-weak-password-hashing-via-unsalted-sha-1 ↗