CVE-2024-3837: Unauthenticated WebAuthn Enrollment Leading to Account Takeover Analysis and Fix

Vulnerability Summary: Unauthenticated WebAuthn Enrollment Leads to Account Takeover Vulnerability Overview Vulnerability Name: Unauthenticated WebAuthn enrollment permits takeover of existing accounts CVE Number: CVE-2024-3837 CVSS Score: 8.8 (High Severity) Vulnerability Type: Authentication Bypass / Account Takeover Root Cause: - During the enrollment process, the server does not verify if the user is logged in or possesses a valid session. - An attacker can forge a request to add new WebAuthn credentials (such as FIDO2 security keys) to any target account. - Due to the lack of validation for the "enrollee identity," the attacker can bind the new credentials to the target account without a password, thereby bypassing the existing authentication mechanism to achieve account takeover. Impact Scope Affected Components: - Systems using WebAuthn for two-factor authentication (2FA) or primary authentication. - Specifically, services that handle registration options at or similar endpoints without verifying session/login status. Affected Users: - All user accounts that have enabled WebAuthn authentication. - Attackers only need to know the target username (or email) to add new credentials and take over the account. Potential Consequences: - Complete account takeover (without password, without original device). - Subsequent attacks such as data exfiltration, privilege escalation, and lateral movement. Remediation Plan 1. Enforce Session Verification: - Before generating , verify that the current request originates from a logged-in user (check session token / JWT / cookie). - Reject registration option requests from unauthenticated users. 2. Bind Credentials to Specific User: - When storing new WebAuthn credentials, explicitly associate them with the ID of the currently logged-in user (rather than relying solely on username or email). - Avoid using identifiers that can be guessed or enumerated as the basis for credential ownership. 3. Add Enrollment Confirmation Mechanism: - For new credential enrollment, require the user to confirm via an existing authentication method (such as password, SMS OTP, or email confirmation). - Introduce a "registration challenge" mechanism to ensure the operation is initiated by a legitimate user. 4. Logging and Monitoring: - Log all WebAuthn registration events, including IP, time, user ID, and credential type. - Trigger alerts for suspicious registration behavior (such as multiple registrations in a short time span or registrations across different IPs). 5. Client-Side Protection: - The frontend should ensure the user is logged in before calling the registration interface. - Do not expose the registration endpoint to unauthorized users. --- POC / Exploitation Code (Full Extraction) > Note: Actual exploitation requires first obtaining the returned by the server (containing the challenge), then constructing the above request. The attacker does not need to be logged in to submit this request, thereby adding new WebAuthn credentials to . Example Full Exploitation Flow (Pseudocode): > ⚠️ Note: In actual attacks, the attacker must simulate real FIDO2 device behavior, but the core vulnerability lies in the server not verifying "who is enrolling." Therefore, even forged credentials can be successfully bound. --- Additional Notes This vulnerability exists in multiple open-source projects and enterprise systems, particularly common in scenarios where WebAuthn authentication logic is implemented independently. After remediation, it is recommended to conduct penetration testing to verify whether the registration endpoint still accepts unauthenticated requests. Refer to the "Registration Flow" security requirements in the FIDO Alliance Best Practices.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-3837: Unauthenticated WebAuthn Enrollment Leading to Account Takeover Analysis and Fix

More from this source