CVE-2024-41800: Craft CMS Allows TOTP Token To Stay Valid After Use
Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period.
Impact
An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials.
A TOTP token can be used multiple times to establish an authenticated session. RFC 6238 insists that an OTP must not be used more than once.
> The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP.
The OWASP Application Security Verification Standard v4.0.3 (ASVS) reiterates this property with requirement 2.8.4.
> Verify that time-based OTP can be used only once within the validity period.
It should also be noted that the validity period of an TOTP token is 2 minutes. This makes a successful brute force attack more likely, since the four tokens are valid at the same time.
Patches
This has been patched in Craft 5.2.3.
References:
https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV 2024061701CraftCMSTOTPValidAfterUse
https://github.com/craftcms/cms/releases/tag/5.2.3
Other sources
Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. This has been patched in Craft 5.2.3.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41800?
CVE-2024-41800 is a high severity vulnerability that allows attackers to reuse TOTP tokens within their validity period.
How do I fix CVE-2024-41800?
To fix CVE-2024-41800, upgrade to Craft CMS version 5.2.3 or later.
What systems are affected by CVE-2024-41800?
CVE-2024-41800 affects Craft CMS versions between 5.0.0-beta1 and 5.2.2.
What impact does CVE-2024-41800 have on authentication security?
CVE-2024-41800 compromises authentication security by allowing attackers who know a victim's credentials to reuse valid TOTP tokens.
Is there any mitigation for CVE-2024-41800 before upgrading?
There are no effective mitigations for CVE-2024-41800 other than upgrading to the patched version.