GitHub Advisoryadvisory · Maven

GHSA-v9hx-v6vf-g36j WebAuthn4J Spring Security Improper signature counter value handling

MEDIUM Published 2023-10-17 Modified 2023-10-17 Official page ↗
Aliases
CVE-2023-45669
Ecosystem
Maven
Packages
com.webauthn4j:webauthn4j-spring-security-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-287
Reviewed
2023-10-17

Affected packages

• Maven com.webauthn4j:webauthn4j-spring-security-core: < 0.9.1.RELEASE → fixed in 0.9.1.RELEASE

Description

Improper signature counter value handling Impact A flaw was found in webauthn4j-spring-security-core. When an authneticator returns an incremented signature counter value during authentication, webauthn4j-spring-security-core does not properly persist the value, which means cloned authenticator detection does not work. An attacker who cloned valid authenticator in some way can use the cloned authenticator without being detected. Patches Please upgrade to `com.webauthn4j:webauthn4j-spring-security-core:0.9.1.RELEASE` References For more details about WebAuthn signature counters, see WebAuthn specification 6.1.1. Signature Counter Considerations. Reporter This issue was discovered by Michael Budnick (@mbudnick)

Related

Alias · CVE (1)

  • CVE-2023-45669 WebAuthn4J Spring Security provides Web Authentication specification support for Spring applications. vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References