GitHub Advisoryadvisory · Go

GHSA-7j7j-66cv-m239 ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

HIGH Published 2024-04-25 Modified 2024-11-18 Official page ↗
Aliases
CVE-2024-32868
Ecosystem
Go
Packages
github.com/zitadel/zitadel
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-287, CWE-297, CWE-307
Reviewed
2024-04-25

Affected packages

• Go github.com/zitadel/zitadel: < 2.50.0 → fixed in 2.50.0

Description

Impact ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password check attempts, there was no such mechanism for (T)OTP checks. Patches 2.x versions are fixed on >= 2.50.0 Workarounds There is no workaround since a patch is already available. References None Questions If you have any questions or comments about this advisory, please email us at [email protected] Credits Thanks to Jack Moran from Layer 9 Information Security, Ethan from zxsecurity and Amit Laish from GE Vernova for finding and reporting the vulnerability.

Related

Alias · CVE (1)

  • CVE-2024-32868 ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. vulnerability

Weakness · CWE (3)

  • CWE-287 Improper Authentication weakness
  • CWE-297 Improper Validation of Certificate with Host Mismatch weakness
  • CWE-307 Improper Restriction of Excessive Authentication Attempts weakness

References