CVE-2024-5658: Improper Authentication in CraftCMS Two-Factor Authentication Plugin
Summary
CVE-2024-5658: Improper Authentication in CraftCMS two factor authentication plugin. Affects born05/craft-twofactorauthentication versions < 3.3.4. Fixed in 3.3.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CraftCMS is a popular content management system that allows users to create and manage websites. The Two-Factor Authentication plugin is designed to add an extra layer of security to CraftCMS installations by requiring users to provide a second form of authentication, such as a Time-based One-Time Password (TOTP). This plugin helps protect against unauthorized access to user accounts and sensitive information.
Vulnerability Detail
The CraftCMS Two-Factor Authentication plugin, through version 3.3.3, contains a vulnerability that allows for the reuse of TOTP tokens multiple times within their validity period. This means that an attacker who obtains a valid TOTP token can use it multiple times to authenticate without the need for a new token. This improper authentication can lead to unauthorized access to user accounts and potential exposure of sensitive information.
How To Fix
Minimum fixed version
3.3.4
This is the first release that contains the fix.
composer require born05/craft-twofactorauthentication:3.3.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the Two-Factor Authentication plugin until the update is applied. This can be done by accessing the CraftCMS admin panel, navigating to the plugin settings, and disabling the Two-Factor Authentication plugin. However, it is important to note that disabling the plugin will remove the additional security provided by two-factor authentication.
Conclusion
The CraftCMS Two-Factor Authentication plugin contains a vulnerability that allows for the reuse of TOTP tokens, potentially leading to unauthorized access to user accounts. It is important to update the plugin to the latest version to fix this issue and ensure the security of user accounts and sensitive information. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for born05/craft-twofactorauthentication →
FAQ
CraftCMS is a content management system that allows users to create and manage websites.
The Two-Factor Authentication plugin is an add-on for CraftCMS that adds an extra layer of security by requiring users to provide a second form of authentication.
A Time-based One-Time Password (TOTP) token is a temporary code that is generated based on the current time and a shared secret. It is used for two-factor authentication.
The vulnerability allows for the reuse of TOTP tokens, which means that an attacker who obtains a valid token can use it multiple times to authenticate without the need for a new token. This can lead to unauthorized access to user accounts and potential exposure of sensitive information.
To fix the vulnerability, it is recommended to update the CraftCMS Two-Factor Authentication plugin to version 3.3.4 or later.
Related vulnerabilities
Recent vulnerabilities recorded for born05/craft-twofactorauthentication.
