Summary
PHPNuxBill contains an authentication bypass in RADIUS CHAP verification that can accept an incorrect password when a valid customer or PPPoE username is supplied. An attacker who knows such a username may obtain network access through MikroTik hotspot or PPPoE CHAP authentication and consume the associated customer's service plan.
PHPNuxBill contains an authentication bypass in RADIUS CHAP verification that can accept an incorrect password when a valid customer or PPPoE username is supplied. An attacker who knows such a username may obtain network access through MikroTik hotspot or PPPoE CHAP authentication and consume the associated customer's service plan.
Affected context
The vulnerability occurs in PHPNuxBill deployments that use RADIUS CHAP verification for MikroTik hotspot or PPPoE authentication. Risk is present when an attacker can identify a valid customer or PPPoE username and the authentication flow relies on the affected password verification behavior.
The vulnerability occurs in PHPNuxBill deployments that use RADIUS CHAP verification for MikroTik hotspot or PPPoE authentication. Risk is present when an attacker can identify a valid customer or PPPoE username and the authentication flow relies on the affected password verification behavior.
Exploit preconditions
- Attack surface: RADIUS-based authentication used by MikroTik hotspot or PPPoE services
- Required access: Knowledge of a valid customer or PPPoE username
- Trigger point: CHAP authentication handled by the
Password::chap_verify()verification path - Why exploitation is possible: The verifier returns a successful result when the supplied response does not match the expected value
- Attack surface: RADIUS-based authentication used by MikroTik hotspot or PPPoE services
- Required access: Knowledge of a valid customer or PPPoE username
- Trigger point: CHAP authentication handled by the
Password::chap_verify()verification path - Why exploitation is possible: The verifier returns a successful result when the supplied response does not match the expected value
Why this happens
The underlying bug is an authentication decision error in the CHAP verification routine. Instead of rejecting a response when it fails comparison with the expected authentication value, the routine can return a successful result, allowing an invalid credential response to satisfy the authentication check. This behavior maps to CWE-287: Improper Authentication, because the system does not correctly verify the identity claim before granting access.
The underlying bug is an authentication decision error in the CHAP verification routine. Instead of rejecting a response when it fails comparison with the expected authentication value, the routine can return a successful result, allowing an invalid credential response to satisfy the authentication check. This behavior maps to CWE-287: Improper Authentication, because the system does not correctly verify the identity claim before granting access.
Potential impact
- An attacker may obtain unauthorized network access
- An attacker could consume bandwidth or service time from another customer's plan
- Customer accounts may incur unauthorized usage or resource depletion
- Network operators may experience abuse of hotspot or PPPoE services
- Related monitoring and billing data may become less reliable
- An attacker may obtain unauthorized network access
- An attacker could consume bandwidth or service time from another customer's plan
- Customer accounts may incur unauthorized usage or resource depletion
- Network operators may experience abuse of hotspot or PPPoE services
- Related monitoring and billing data may become less reliable
General mitigation guidance
Mitigation generally focuses on ensuring that authentication succeeds only after a valid CHAP response is positively verified.
Common defensive patterns include:
- Rejecting all mismatched, malformed, missing, or otherwise invalid authentication responses
- Using a fail-closed verification implementation with explicit success conditions
- Centralizing credential and challenge-response validation in well-tested authentication components
- Applying least privilege to authenticated network sessions and customer service plans
- Limiting repeated authentication attempts and monitoring unusual account or plan consumption
- Adding regression tests for incorrect passwords, malformed responses, and boundary conditions
Mitigation generally focuses on ensuring that authentication succeeds only after a valid CHAP response is positively verified.
Common defensive patterns include:
- Rejecting all mismatched, malformed, missing, or otherwise invalid authentication responses
- Using a fail-closed verification implementation with explicit success conditions
- Centralizing credential and challenge-response validation in well-tested authentication components
- Applying least privilege to authenticated network sessions and customer service plans
- Limiting repeated authentication attempts and monitoring unusual account or plan consumption
- Adding regression tests for incorrect passwords, malformed responses, and boundary conditions
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis and code review checks for inverted comparison results or unconditional success paths in authentication functions
- Tests that confirm incorrect CHAP responses are rejected across hotspot and PPPoE flows
- Review of authentication logs for successful sessions associated with repeated failures or unexpected usage patterns
- Policy enforcement requiring explicit, positive credential verification before network access is granted
- Automated security testing and code review tools that identify improper authentication and fail-open logic
Organizations can look for this class of issue through:
- Static analysis and code review checks for inverted comparison results or unconditional success paths in authentication functions
- Tests that confirm incorrect CHAP responses are rejected across hotspot and PPPoE flows
- Review of authentication logs for successful sessions associated with repeated failures or unexpected usage patterns
- Policy enforcement requiring explicit, positive credential verification before network access is granted
- Automated security testing and code review tools that identify improper authentication and fail-open logic
