Executive Summary

Cerebrate before version 1.37 had a vulnerability where credential material from self-registration requests was exposed. Specifically, the self-registration workflow stored the registrant’s hashed password in the inbox message data payload. This hashed password was returned unredacted in inbox index and view responses, including HTML, JSON, and CSV outputs, and could also appear unredacted in audit log entries.

An authenticated user with sufficient privileges to access inbox entries or related audit logs could retrieve these password hashes. Although the exposed data were password hashes rather than plaintext passwords, this exposure could enable offline password-cracking attempts, especially if users reuse passwords across different systems.

The issue was fixed in Cerebrate version 1.37 by redacting sensitive password and authentication key fields from inbox display and API output, as well as recursively redacting those fields from JSON values written to audit logs, while still preserving the stored registration payload for account creation processing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by exposing hashed passwords from self-registration requests to authenticated users with access to inbox entries or audit logs. While the passwords are hashed, attackers could attempt offline password cracking to recover the original passwords.

If users reuse passwords across multiple systems, the exposure of these hashes increases the risk of unauthorized access to other accounts or systems beyond Cerebrate.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in Cerebrate version 1.37 by redacting sensitive password and authkey fields from inbox display and API output, as well as from audit logs.

Therefore, the immediate step to mitigate this vulnerability is to upgrade Cerebrate to version 1.37 or later.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability exposes hashed password material through inbox messages and audit logs, which could lead to offline password-cracking attempts if accessed by unauthorized users with sufficient privileges.

While the exposed data is hashed rather than plaintext, the disclosure of such sensitive authentication information may increase the risk of unauthorized access, especially if users reuse passwords across systems.

This exposure could potentially impact compliance with standards like GDPR and HIPAA, which require protection of personal and authentication data to prevent unauthorized disclosure and ensure data confidentiality.

The issue was fixed in Cerebrate version 1.37 by redacting sensitive password and authentication key fields from inbox displays, API outputs, and audit logs, thereby reducing the risk of non-compliance.

Useful 0 Not Useful 0