Patch insecure CSRF token crypto vulnerability

[Arinerron]

I noticed that CSRF tokens are not using a cryptographically secure pseudorandom number generator. An attacker could potentially "guess" the CSRF token, allowing them to control vesta. The current algorithm for generating CSRF tokens is md5(uniqid(mt_rand(), true)), but it should use an algorithm that is considered cryptographically secure (for example, bin2hex(openssl_random_pseudo_bytes(32)) or bytes from /dev/urandom).

This pull request simply replaces the insecure crypto with the secure function.

To test if the code worked, I made this little script:

<?php
echo bin2hex(openssl_random_pseudo_bytes(16));
?>

The output is something like:

da202fd306550e3ad02fcbf2ac0838d4

The insecure algorithm (being used now) generates tokens like this:

11b1ec9936e32e555c7a32046871abc0

Same length, just more secure. Here's a stackoverflow post about it: http://stackoverflow.com/a/2595372

Also,
http://php.net/manual/en/function.mt-rand.php
http://php.net/manual/en/function.rand.php
If you scroll down on either of those documentation pages, you'll see the warning about how it does not generate cryptographically secure values.

Thanks!

[dpeca]

Thank you @Arinerron :)

[dpeca]

uhhh, looks like you used undefined function... panel is now broken...

PHP Fatal error: Call to undefined function openssl_random_pseudo_bytes() in /usr/local/vesta/web/login/index.php on line 129

I must revert this.

@Arinerron, it would be nice if you setup virtualbox and install Vesta, then you can test your code before you send push requests, cheers :)

[Arinerron]

@dpeca Ugh, sorry. You need the OpenSSL PHP module: http://us3.php.net/manual/en/book.openssl.php

It says it come with PHP >=5.3.0, PHP 7 by default.

http://php.net/manual/en/function.openssl-random-pseudo-bytes.php

[dpeca]

I think VestaCP has its own seperated PHP parser - /usr/local/vesta/php/bin/php

Only @serghey-rodin can rebuild it.

[anton-reutov]

Should be rechecked by Sergey Rodin or Dmitry Naumov-Socolov

[Arinerron]

This pull request was merged but reverted. The issue still exists in master. Waiting on @serghey-rodin to rebuild with the OpenSSL PHP module.