PT-2024-5376 · Twilio · Twilio Authy Android+2

Published 2024-07-01 · Updated 2024-12-20 · CVE-2024-39891

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Twilio Authy Android versions prior to 25.1.0 Twilio Authy iOS versions prior to 26.1.0

Description The issue concerns an unauthenticated endpoint in the Twilio Authy API that provided access to certain phone-number data. This endpoint accepted a stream of requests containing phone numbers and responded with information about whether each phone number was registered with Authy. The issue was exploited in the wild in June 2024, but Authy accounts were not compromised. The vulnerability is related to information disclosure due to inconsistency.

Recommendations For Twilio Authy Android versions prior to 25.1.0, update to version 25.1.0 or later to resolve the issue. For Twilio Authy iOS versions prior to 26.1.0, update to version 26.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the unauthenticated endpoint in the Twilio Authy API until a patch is applied.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

BDU:2024-06009

CVE-2024-39891

Affected Products

Twilio Authy Api

Twilio Authy Android

Twilio Authy Ios

References · 14

• https://bdu.fstec.ru/vul/2024-06009 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39891 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39891 · Security Note
• https://twilio.com/en-us/changelog/Security_Alert_Authy_App_Android_iOS · Security Note
• https://t.me/thehackernews/5300 · Telegram Post
• https://t.me/cvenotify/87244 · Telegram Post
• https://cwe.mitre.org/data/definitions/203.html · Note
• https://t.me/cvenotify/87186 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-39891 · Note
• https://bleepingcomputer.com/news/security/hackers-abused-api-to-verify-millions-of-authy-mfa-phone-numbers · Note
• https://twilio.com/en-us/changelog · Note
• https://twilio.com/docs/usage/security/reporting-vulnerabilities · Note
• https://vuldb.com/?id.270260 · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note