PT-2024-15397 · Unknown · Devise-Two-Factor

Published

2024-01-11

·

Updated

2024-03-18

·

CVE-2024-0227

CVSS v3.1

5.0

Medium

VectorAV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions Devise-Two-Factor (affected versions not specified)
Description The issue concerns Devise-Two-Factor not throttling or restricting login attempts at the server by default. When combined with the Time-based One Time Password algorithm's (TOTP) inherent entropy limitations, it's possible for an attacker to bypass the 2FA mechanism through brute-force attacks. If a user's username and password have already been compromised, an attacker could try possible TOTP codes to log in as that user without the user's knowledge.
Recommendations To mitigate this threat, consider the following:
  1. Implement the lockable strategy from Devise to lock a user after a certain number of failed login attempts.
  2. Configure a rate limit for your application, especially on the login endpoints.
  3. Display generic error messages for authentication errors, hiding whether the failure was due to a username/password combination or a two-factor code. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2024-0227
GHSA-CHCR-X7HC-8FP8

Affected Products

Devise-Two-Factor