Craft CMS Allows TOTP Token To Stay Valid After Use
Summary
CVE-2024-41800: Craft CMS Allows TOTP Token To Stay Valid After Use. Affects craftcms/cms versions >= 5.0.0-beta.1, < 5.2.3. Fixed in 5.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Craft CMS is a content management system that allows users to create and manage websites. It provides a range of features and functionality for building and maintaining websites, including user authentication and security measures. However, a vulnerability has been discovered in Craft CMS 5 that allows TOTP tokens to remain valid after use, potentially compromising the security of authenticated sessions.
Vulnerability Detail
The vulnerability in Craft CMS 5 allows an attacker to reuse a valid TOTP token multiple times within its validity period. This means that an attacker who has knowledge of a victim's credentials can submit a valid TOTP token to establish an authenticated session. This goes against the recommended practice outlined in RFC 6238, which states that an OTP (one-time password) must not be used more than once. The OWASP Application Security Verification Standard v4.0.3 also emphasizes the importance of one-time use for time-based OTPs. Additionally, the short validity period of the TOTP token (2 minutes) increases the likelihood of a successful brute force attack.
How To Fix
Minimum fixed version
5.2.3
This is the first release that contains the fix.
composer require craftcms/cms:5.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to apply the patch provided in Craft CMS 5.2.3.
Conclusion
Craft CMS 5 is vulnerable to a TOTP token reuse vulnerability, which allows an attacker to establish an authenticated session using a valid TOTP token multiple times. This goes against the recommended practice of one-time use for OTPs. The vulnerability has been patched in Craft CMS 5.2.3, and users are advised to update their installation to mitigate the risk. No specific workaround is mentioned for this vulnerability.
See every vulnerability recorded for craftcms/cms →
FAQ
Craft CMS is a content management system that allows users to create and manage websites. It provides a range of features and functionality for building and maintaining websites.
A TOTP (Time-Based One-Time Password) token is a temporary password that is valid for a short period of time. It is commonly used for two-factor authentication to provide an additional layer of security.
The vulnerability allows an attacker to reuse a valid TOTP token multiple times within its validity period. This can lead to unauthorized access to authenticated sessions if the attacker has knowledge of the victim's credentials.
To fix this vulnerability, it is recommended to update Craft CMS to version 5.2.3 or later. This patch addresses the issue and prevents the reuse of TOTP tokens.
There is no specific workaround mentioned for this vulnerability. The recommended solution is to apply the patch provided in Craft CMS 5.2.3.
References
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
