PT-2022-16736 · Yubico · Yubikey

Published 2022-05-11 · Updated 2024-08-03 · CVE-2022-24584

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions YubiKey (affected versions not specified)

Description The issue concerns incorrect access control in the Yubico OTP functionality of the YubiKey hardware tokens and the Yubico OTP validation server. The Yubico OTP is supposed to create hardware-bound second-factor credentials. A user can reprogram the OTP functionality using the Yubico Personalization Tool and then upload the new configuration to Yubico's OTP validation servers. The vendor disputes this issue, stating that a YubiKey device cannot prevent a user from deciding to store a secret value elsewhere after it has been imported into the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-24584

Affected Products

Yubikey

References · 7

• 🔥 https://pastebin.com/7iLR1EbW · Exploit
• https://demo.yubico.com/otp/verify · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24584 · Security Note
• https://upload.yubico.com · Vendor Advisory
• https://t.me/cvenotify/88696 · Telegram Post
• https://t.me/cibsecurity/42421 · Telegram Post
• https://pastebin.com/xAh8uV6J · Note