5

I was surprised that we can access to admin backend resetting admin user password with md5. 

UPDATE `admin_user` SET `password` = MD5('anyword') WHERE `admin_user`.`user_id`= 1;

This is some kind of Magento feature or vulnerability? Why password is not depend on encryption key in local.xml?

Improve this question
4
  • 1
    It was a feature but is a vulnerability, because md5 is not broken, but weak. I implemented a extension which replaces the md5 hashing with PBKDF2 for admin users, customer and api passwords: github.com/ikonoshirt/pbkdf2 The description says don't use it in production but we and a few others use it without problems.
    – Fabian Blechschmidt
    Commented Aug 22, 2014 at 12:07
  • Being able to reset a password this way is not considered a vulnerability. But using an unsalted hash is considered a vulnerability. If support for unsalted hashes only exists for backward compatibility, that is not a problem. But if it uses unsalted hashes by default for new passwords, then that is a vulnerability.
    – kasperd
    Commented Aug 22, 2014 at 12:21
  • @FabianBlechschmidt MD5 is broken, but not in a way that directly affects its use in password hashing. Using MD5 is only a minor problem compared to the lack of salt. Salted MD5 would be much stronger than unsalted SHA512. If PBKDF2 is used correctly, it solves both problems, but PBKDF2 could also be used incorrectly.
    – kasperd
    Commented Aug 22, 2014 at 12:44
  • Ah yea, you are right about the backwards compatibility. But nonetheless is md5 with salt compared to any new tecnique like pbkdf2, scrypt or bcrypt hacked very fast. And if you know how to use PBKDF2 I would be proud if you review the code ;)
    – Fabian Blechschmidt
    Commented Aug 22, 2014 at 13:18

1 Answer 1

Reset to default
6

The encryption key is used for encryption and decryption, not for hashing.
The user and admin passwords are just hashed.
See how Mage_Admin_Model_User::_beforeSave works. 

$data['password'] = $this->_getEncodedPassword($this->getNewPassword());

if you dig deeper into _getEncodedPassword you will find this: 

protected function _getEncodedPassword($password)
{
    return Mage::helper('core')->getHash($password, 2);
}

Going deeper and deeper you end up on this method for CE:

public function hash($data)
{
    return md5($data);
}

and on this for EE.

public function hash($data, $version = self::HASH_VERSION_LATEST)
{
    if (self::HASH_VERSION_MD5 === $version) {
        return md5($data);
    }
    return hash('sha256', $data);
}

As for the reason "why" is done this way...I guess it just how it is.
The only reason I can think of is portability. You can transfer customers and admins from one instance to an other and the passwords will still work.

Improve this answer
5
  • But this means any bad man can access user and admin profiles if he has access to database even not using files.
    – mageUz
    Commented Aug 22, 2014 at 7:57
  • 1
    If he can access the admin profiles with only db access he can access everything else. He can even download a copy of your db and use it on his own magento instance. So you got a bigger problem than that if someone has access to your db.
    – Marius ♦
    Commented Aug 22, 2014 at 7:59
  • Debatable point, with passwords stored in plain md5 someone having access to your db gets access to your password which he can further use on the other places.
    – Cthulhu
    Commented Aug 22, 2014 at 13:55
  • 1
    @Cthulhu. You have a point, but if you use the same password for your admin shop and your gmail account...well...you see where I'm going with this.
    – Marius ♦
    Commented Aug 22, 2014 at 13:58
  • If the passwords were dependent on the encryption key, they would be rendered unusable if the key were ever changed. Maybe this is why they're not.
    – toon81
    Commented Jul 18, 2016 at 10:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.