2 FA bypass in ikus060/rdiffweb

Valid

Reported on

Oct 3rd 2022


Description

An attacker is able to bypass 2FA due to a logic flaw on the application

Proof of Concept

1) Go to https://rdiffweb-dev.ikus-soft.com/prefs/general
2) Your account is set to abc@gmail.com as primary email
3) Go to https://rdiffweb-dev.ikus-soft.com/prefs/mfa and click on "Enable 2FA"
4) A confirmation code will be sent to your email
5) Lets say the company admin has changed the email associated with the account. Session will still persist as session does not expire on email change .Now lets go back to https://rdiffweb-dev.ikus-soft.com/prefs/general and change the email
6) Previous session still persists. Use the token in step 4 and enable 2FA 
7) 2FA is successfully enabled . 



# Impact

Due to lack of code and email integration , old confirmation codes still remain valid on email change , hence allows attacker the misuse this to cause a 2FA bypass
We are processing your report and will contact the ikus060/rdiffweb team within 24 hours. 2 months ago
We have contacted a member of the ikus060/rdiffweb team and are waiting to hear back 2 months ago
We have sent a follow up to the ikus060/rdiffweb team. We will try again in 7 days. 2 months ago
We have sent a second follow up to the ikus060/rdiffweb team. We will try again in 10 days. 2 months ago
Patrik Dufresne validated this vulnerability 2 months ago
nehalr777 has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
nehalr777
2 months ago

Researcher


@maintainer , happy to assign a CVE for this?

We have sent a fix follow up to the ikus060/rdiffweb team. We will try again in 7 days. a month ago
Patrik Dufresne marked this as fixed in 2.5.0a7 with commit c27c46 a month ago
Patrik Dufresne has been awarded the fix bounty
This vulnerability will not receive a CVE
Patrik Dufresne published this vulnerability 21 days ago
to join this conversation