Take the 2-minute tour ×
Magento Stack Exchange is a question and answer site for users of the Magento e-Commerce platform. It's 100% free, no registration required.

I was surprised that we can access to admin backend resetting admin user password with md5.

UPDATE `admin_user` SET `password` = MD5('anyword') WHERE `admin_user`.`user_id`= 1;

This is some kind of Magento feature or vulnerability? Why password is not depend on encryption key in local.xml?

share|improve this question
    
It was a feature but is a vulnerability, because md5 is not broken, but weak. I implemented a extension which replaces the md5 hashing with PBKDF2 for admin users, customer and api passwords: github.com/ikonoshirt/pbkdf2 The description says don't use it in production but we and a few others use it without problems. –  Fabian Blechschmidt Aug 22 at 12:07
    
Being able to reset a password this way is not considered a vulnerability. But using an unsalted hash is considered a vulnerability. If support for unsalted hashes only exists for backward compatibility, that is not a problem. But if it uses unsalted hashes by default for new passwords, then that is a vulnerability. –  kasperd Aug 22 at 12:21
    
@FabianBlechschmidt MD5 is broken, but not in a way that directly affects its use in password hashing. Using MD5 is only a minor problem compared to the lack of salt. Salted MD5 would be much stronger than unsalted SHA512. If PBKDF2 is used correctly, it solves both problems, but PBKDF2 could also be used incorrectly. –  kasperd Aug 22 at 12:44
    
Ah yea, you are right about the backwards compatibility. But nonetheless is md5 with salt compared to any new tecnique like pbkdf2, scrypt or bcrypt hacked very fast. And if you know how to use PBKDF2 I would be proud if you review the code ;) –  Fabian Blechschmidt Aug 22 at 13:18

1 Answer 1

The encryption key is used for encryption and decryption, not for hashing.
The user and admin passwords are just hashed.
See how Mage_Admin_Model_User::_beforeSave works.

$data['password'] = $this->_getEncodedPassword($this->getNewPassword());

if you dig deeper into _getEncodedPassword you will find this:

protected function _getEncodedPassword($password)
{
    return Mage::helper('core')->getHash($password, 2);
}

Going deeper and deeper you end up on this method for CE:

public function hash($data)
{
    return md5($data);
}

and on this for EE.

public function hash($data, $version = self::HASH_VERSION_LATEST)
{
    if (self::HASH_VERSION_MD5 === $version) {
        return md5($data);
    }
    return hash('sha256', $data);
}

As for the reason "why" is done this way...I guess it just how it is.
The only reason I can think of is portability. You can transfer customers and admins from one instance to an other and the passwords will still work.

share|improve this answer
    
But this means any bad man can access user and admin profiles if he has access to database even not using files. –  mageUz Aug 22 at 7:57
1  
If he can access the admin profiles with only db access he can access everything else. He can even download a copy of your db and use it on his own magento instance. So you got a bigger problem than that if someone has access to your db. –  Marius Aug 22 at 7:59
    
Debatable point, with passwords stored in plain md5 someone having access to your db gets access to your password which he can further use on the other places. –  Cthulhu Aug 22 at 13:55
1  
@Cthulhu. You have a point, but if you use the same password for your admin shop and your gmail account...well...you see where I'm going with this. –  Marius Aug 22 at 13:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.