Grav Login Plugin CSRF Vulnerability (CVE-2020-62671) Allows 2FA Secret Reset

Vulnerability Overview A CSRF vulnerability exists in , allowing anonymous attackers to rotate the 2FA (TOTP) keys of logged-in users. This vulnerability occurs in the task, which is responsible for generating and persisting new TOTP keys. This task lacks CSRF protection and does not perform Origin/Referer checks, enabling attackers to trigger this task via Cross-Site Request Forgery (CSRF). Affected Versions Affected versions: versions <= 3.8.10 Fixed version: version 3.8.11 Impact conditions: - The site must have 2FA enabled. - The user must have 2FA enabled and have an active session. - For users without 2FA enabled, the rotation operation is benign and self-healing. Remediation 1. Core Fix: - Add CSRF protection to the task in , similar to other tasks. - Ensure the task is protected. 2. Update Frontend Code: - Update to include the field when sending non-empty requests, ensuring that the legitimate "regenerate key" button functions correctly. POC Code Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality: None - Integrity: Low - Availability: Low CVE ID: CVE-2020-62671 Weakness: CWE-352 Credit: CyberKareem Recommended Fixes: - Add CSRF protection in . - Update to include the field. Summary This vulnerability allows attackers to rotate the 2FA keys of logged-in users via CSRF attacks, resulting in interruption of user account access and forcing re-enablement of 2FA. The remediation includes adding CSRF protection to the task and updating the frontend code to include the necessary fields.

Goal Reached Thanks to every supporter — we hit 100%!

Grav Login Plugin CSRF Vulnerability (CVE-2020-62671) Allows 2FA Secret Reset

More from this source