Rodauth WebAuthn Login Account Takeover (ATO) Fix & PoC

Vulnerability Overview Type: Account Takeover (ATO) vulnerability in the WebAuthn login feature. Cause: When the WebAuthn login feature is enabled, if a user is already logged in, the system fails to verify whether the matches the account in the current session, allowing an attacker to take over the account using an authenticated WebAuthn client. Fix: Add validation logic in to ensure matches the current account; if there is a mismatch, raise an . Affected Scope Affected Files: - - - Affected Versions: Rodauth 2.47.0 and earlier (inferred from commit messages). Fix Details Code Changes: - In , add validation for in the method: - In , add a test case verifying that an is raised when does not match: - In , add a test case verifying that an is raised when does not match: ```ruby it 'should support setup, authentication and removal using internal requests' do rodauth do enable :webauthn, :internal_request hmac_secret '123' domain 'example.com' end roda do webauthn_client = WebAuthn::FauClient.new('https://example.com') webauthn_client = WebAuthn::FauClient.new('http://example.com') [true, false].each do it "should support setup, authentication and removal using internal requests (with webauthn_login: #{webauthn_login})" do rodauth do enable :webauthn, :internal_request enable :webauthn_login if webauthn_login hmac_secret '123' domain 'example.com' end roda do webauthn_client = WebAuthn::FauClient.new('https://example.com') webauthn_client = WebAuthn::FauClient.new('http://example.com') proc { app.rodauth.webauthn_setup_params(account_login: 'food@example.com') }.must_raise Rodauth::InternalRequestError setup_params = app.rodauth.webauthn_setup_params(account_login: 'food@example.com') webauthn_client = WebAuthn::FauClient.new('https://example.com') webauthn_client = WebAuthn::FauClient.new('http://example.com') proc { app.rodauth.webauthn_setup_params(account_login: 'food@example.com') }.must_raise Rodauth::InternalRequestError setup_params = app.rodauth.webauthn_setup_params(account_login: 'food@example.com') webauthn_setup_challenge_mac = setup_params[:webauthn_setup_challenge_mac] webauthn_client = WebAuthn::FauClient.new('https://example.com') webauthn_client = WebAuthn::FauClient.new('http://example.com') proc { app.rodauth.webauthn_auth_params(account_login: 'food@example.com') }.must_raise Rodauth::InternalRequestError auth_params = app.rodauth.webauthn_auth_params(account_login: 'food@example.com') webauthn_auth_challenge_mac = auth_params[:webauthn_auth_challenge_mac] webauthn_client = WebAuthn::FauClient.new('https://example.com') webauthn_client = WebAuthn::FauClient.new('http://example.com') proc { app.rodauth.webauthn_auth_params(account_login: 'food@example.com') }.must_raise Rodauth::InternalRequestError auth_params = app.rodauth.webauthn_auth_params(account_login: 'food@example.com') webauthn_auth_challenge_mac = auth_params[:webauthn_auth_challenge_mac] webauthn_client = WebAuthn::FauClient.new('https://example.com') webauthn_client = WebAuthn::FauClient.new('http://example.com') proc { app.rodauth.webauthn_auth_params(account_login: 'food@example.com') }.must_raise Rodauth::InternalRequestError auth_params = app.rodauth.webauthn_auth_params(account_login: 'food@example.com') webauthn_auth_challenge_mac = auth_params[:webauthn_auth_challenge_mac] webauthn_client = WebAuthn::FauClient.new('https://example.com') webauthn_client = WebAuthn::FauClient.new('http://example.com') proc { app.rodauth.webauthn_auth_params(account_login: 'food@example.com') }.must_raise Rodauth::InternalRequestError auth_params = app.rodauth.webauthn_auth_params(account_login: 'food@example.com') webauthn_auth_challenge_mac = auth_params[:webauthn_auth_challenge_mac] webauthn_client = WebAuthn::FauClient.new('https://example.com') webauthn_client = WebAuthn::FauClient.new('http://example.com') proc { app.rodauth.webauthn_auth_params(account_login: 'food@example.com') }.must_raise Rodauth::InternalRequestError auth_params = app.rodauth.webauthn_auth_params(account_login: 'food@example.com') webauthn_auth_challenge_mac = auth_params[:webauthn_auth_challenge_mac] webauthn_client = WebAuthn::FauClient.new('https://example.com') webauthn_client = WebAuthn::FauClient.new('http://example.com') proc { app.rodauth.webauthn_auth_params(account_login: 'food@example.com') }.must_raise Rodauth::InternalRequestError auth_params = app.rodauth.webauthn_auth_params(account_login: 'food@example.com') webauthn_auth_challenge_mac = auth_params[:webauthn_auth_challenge_mac] webauthn_client = WebAuthn::FauClient.new('https://example.com') webauthn_client = WebAuthn::FauClient.new('http://example.com') proc { app.rodauth.webauthn_auth_params(account_login: 'food@example.com') }.must_raise Rodauth::InternalRequestError auth_params = app.rodauth.webauthn_auth_params(account_login: 'food@example.com') webauthn_auth_challenge_mac = auth_params[:webauthn_auth_challenge_mac] webauthn_client = WebAuthn::FauClient.new('https://example.com') webauthn_cl

Goal Reached Thanks to every supporter — we hit 100%!

Rodauth WebAuthn Login Account Takeover (ATO) Fix & PoC

More from this source