Bypass Two-Factor Authentication in scheb/two-factor-bundle
Summary
GHSA-h6mp-mc7g-mg49: scheb/two-factor-bundle bypass two-factor authentication with unverified JWT trusted device token. Affects scheb/two-factor-bundle versions >= 3.0.0, < 3.7.0. Fixed in 3.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
scheb/two-factor-bundle is a package available on Packagist that provides two-factor authentication functionality for PHP applications. It allows developers to easily implement an additional layer of security to protect user accounts. However, versions prior to 3.7 are vulnerable to a critical security issue in the JSON Web Token (JWT) library it relies on. This vulnerability can be exploited by an attacker to generate trusted device cookies and bypass the two-factor authentication mechanism.
Vulnerability Detail
The vulnerability in scheb/two-factor-bundle arises from a security flaw in the JWT library it uses. By exploiting this flaw, an attacker can generate their own trusted device cookies, effectively bypassing the two-factor authentication process. This means that even if a user has enabled two-factor authentication, an attacker can gain unauthorized access to their account without needing to provide the second factor of authentication. The impact of this vulnerability is significant, as it undermines the security provided by two-factor authentication.
How To Fix
Minimum fixed version
3.7.0
This is the first release that contains the fix.
composer require scheb/two-factor-bundle:3.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of scheb/two-factor-bundle to ensure the security of the two-factor authentication mechanism.
Conclusion
The scheb/two-factor-bundle package is vulnerable to a critical security issue that allows attackers to bypass two-factor authentication. To mitigate this vulnerability, it is crucial to upgrade to version 3.7.0 or later of the package. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for scheb/two-factor-bundle →
FAQ
scheb/two-factor-bundle is a PHP package that provides two-factor authentication functionality for applications.
The vulnerability allows an attacker to bypass two-factor authentication and gain unauthorized access to user accounts.
To fix this vulnerability, upgrade to version 3.7.0 or later of scheb/two-factor-bundle.
No, there is no known workaround. Upgrading to the fixed version is the recommended solution.
You can find more information about scheb/two-factor-bundle on its official GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for scheb/two-factor-bundle.
