GHSA-7m6h-rg42-m449: Medium severity composer/filament/filament vulnerability
App-based multi-factor authentication management actions did not consistently require the user to confirm their current password. In particular, an authenticated session could set up app-based MFA and obtain recovery codes without password reauthentication. Disabling app-based MFA and regenerating recovery codes also accepted an existing app code or recovery code without requiring the current password. This issue does not affect email-based MFA.
If an attacker gains access to a user's authenticated session, they could enable app-based MFA and obtain recovery codes without knowing the user's password, changing the account's MFA configuration and potentially locking the legitimate user out. This issue does not by itself allow an unauthenticated attacker to sign in.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/filament/filamentto a version that resolves this vulnerability.Fixed in 5.8.3 - Upgrade
Upgrade
composer/filament/filamentto a version that resolves this vulnerability.Fixed in 4.13.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users whose authenticated sessions are compromised are exposed where app-based MFA management is available. Email-based MFA is not affected, and an unauthenticated attacker cannot sign in through this issue alone.
What could an attacker do with a stolen authenticated session?
They could enroll app-based MFA and obtain recovery codes without knowing the current password. They could also disable app-based MFA or regenerate recovery codes using an existing app code or recovery code, potentially changing the account's MFA configuration and locking out the legitimate user.
Does exploiting this issue require the user's password?
No. The affected MFA management actions did not consistently require current-password confirmation; however, the attacker first needs access to an authenticated user session.