CVE-2024-37893: Firefly III MFA Bypass in OAuth Flow
Summary
CVE-2024-37893: Firefly III has a MFA bypass in oauth flow. Affects grumpydictator/firefly-iii versions < 6.1.17. Fixed in 6.1.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Firefly III is an open-source personal finance manager that allows users to track their income, expenses, and budgets. It provides a web-based interface and supports various financial institutions for importing transactions. The vulnerability in Firefly III's OAuth flow allows malicious users to bypass the multi-factor authentication (MFA) check, potentially compromising user data. This vulnerability can be exploited by password spraying attacks, where passwords stolen from other sources are used to gain unauthorized access to Firefly III accounts. The attacker needs to know the victim's username and password, and OAuth applications can be easily enumerated using an incrementing ID.
Vulnerability Detail
The MFA bypass vulnerability in Firefly III's OAuth flow enables attackers to bypass the MFA check and gain unauthorized access to user data. By exploiting this vulnerability, attackers can use password spraying techniques to try signing up an OAuth application to a user's profile. This can be done easily as OAuth applications are easily enumerable using an incrementing ID. To exploit this vulnerability, the attacker needs to know the victim's username and password, along with passwords stolen from other sources. This can lead to unauthorized access to sensitive financial information and potential misuse of user accounts.
How To Fix
Minimum fixed version
6.1.17
This is the first release that contains the fix.
composer require grumpydictator/firefly-iii:6.1.17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While updating to the latest version is the recommended solution, users can also implement the following workarounds:
- Use a unique password for your Firefly III instance to minimize the risk of password spraying attacks.
- Store your password securely, either in a password manager or by memorizing it.
These workarounds can help reduce the likelihood of unauthorized access to your Firefly III account.
Conclusion
The MFA bypass vulnerability in Firefly III's OAuth flow poses a risk to user data and financial information. It is crucial to update to the latest version of Firefly III (v6.1.17 or later) and follow the recommended workarounds to mitigate this vulnerability. Regularly monitoring for security updates and practicing good password hygiene can help protect against potential attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for grumpydictator/firefly-iii →
FAQ
The vulnerability allows attackers to bypass the MFA check in Firefly III's OAuth flow, potentially gaining unauthorized access to user data and financial information.
To protect your Firefly III account, ensure you are running the latest version of Firefly III (v6.1.17 or later) and follow the recommended workarounds, such as using a unique password and storing it securely.
No, this vulnerability requires the attacker to have knowledge of the victim's username, password, and passwords stolen from other sources. It cannot be exploited remotely without this information.
There are no known instances of this vulnerability being exploited in the wild. However, it is important to apply the recommended fixes and follow security best practices to mitigate the risk.
You can find more information about password spraying attacks on the OWASP website: https://owasp.org/www-community/attacks/Password_Spraying_Attack
Related vulnerabilities
Recent vulnerabilities recorded for grumpydictator/firefly-iii.
