Can you explain this vulnerability to me?

This vulnerability in Strapi's @strapi/core package before version 5.10.3 involves the lack of enforcement of a maximum password length when using bcryptjs for password hashing. Bcryptjs truncates passwords longer than 72 bytes silently, meaning only the first 72 bytes are used for authentication. Users can create accounts with passwords longer than 72 bytes but will be authenticated using only the first 72 bytes, reducing the effective entropy of the password and potentially misleading users about the actual password length required. This can lead to a lower likelihood of unintended authentication if an attacker guesses or obtains the truncated portion. Additionally, very long passwords can cause unnecessary processing overhead. The issue is fixed in version 5.10.3.

Useful 0 Not Useful 0

How can this vulnerability impact me? :

The vulnerability reduces the effective strength of passwords longer than 72 bytes by truncating them silently, which may mislead users into thinking their entire password is used for authentication when only the first 72 bytes are. This reduction in entropy can make it easier for attackers to guess or obtain valid credentials if they focus on the truncated portion. It also can cause unnecessary processing overhead due to handling overly long passwords.

Useful 0 Not Useful 0

What immediate steps should I take to mitigate this vulnerability?

Upgrade the @strapi/core package to version 5.10.3 or later, as this version fixes the vulnerability by enforcing a maximum password length when using bcryptjs for password hashing. No known workarounds exist.

Useful 0 Not Useful 0