CVE-2024-41800: Craft CMS Allows TOTP Token To Stay Valid After Use
Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period.
Impact
An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials.
A TOTP token can be used multiple times to establish an authenticated session. RFC 6238 insists that an OTP must not be used more than once.
The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP.
The OWASP Application Security Verification Standard v4.0.3 (ASVS) reiterates this property with requirement 2.8.4.
Verify that time-based OTP can be used only once within the validity period.
It should also be noted that the validity period of an TOTP token is 2 minutes. This makes a successful brute force attack more likely, since the four tokens are valid at the same time.
Patches
This has been patched in Craft 5.2.3.
References:
https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV 2024061701CraftCMSTOTPValidAfterUse
https://github.com/craftcms/cms/releases/tag/5.2.3
Other sources
Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. This has been patched in Craft 5.2.3.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41800?
CVE-2024-41800 is a high severity vulnerability that allows attackers to reuse TOTP tokens within their validity period.
How do I fix CVE-2024-41800?
To fix CVE-2024-41800, upgrade to Craft CMS version 5.2.3 or later.
What systems are affected by CVE-2024-41800?
CVE-2024-41800 affects Craft CMS versions between 5.0.0-beta1 and 5.2.2.
What impact does CVE-2024-41800 have on authentication security?
CVE-2024-41800 compromises authentication security by allowing attackers who know a victim's credentials to reuse valid TOTP tokens.
Is there any mitigation for CVE-2024-41800 before upgrading?
There are no effective mitigations for CVE-2024-41800 other than upgrading to the patched version.