Weak Password Storage in Jivejdon via Unsalted MD5 Hashing

Executive Summary

This vulnerability involves Jivejdon storing account passwords as unsalted MD5 hashes in the user table. The ToolsUtil.hash() function in AccountDaoSql creates these weak hashes without adding salt, making passwords vulnerable to cracking via precomputed tables or GPU attacks if attackers gain database access or exploit SQL injection.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if Jivejdon 5.0 or earlier is running and verify if passwords are stored as unsalted MD5 hashes in the user table. Inspect the database for accounts using ToolsUtil.hash() in AccountDaoSql. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

If you use Jivejdon 5.0 or earlier, attackers who obtain your database or exploit SQL injection could crack your password and gain unauthorized access to your account. This could lead to data theft, account misuse, or further compromise of connected systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for secure password storage. Unsalted MD5 hashes are considered weak and non-compliant with modern security standards, potentially leading to regulatory penalties, fines, or mandatory breach notifications.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Jivejdon to a version that does not use unsalted MD5 for password storage. If upgrading is not possible, implement a password hashing mechanism with salt and enforce strong password policies. Review database access controls to prevent unauthorized access.

Useful 0 Not Useful 0