CVE-2024-41800: Craftcms/cms Craft CMS Allows TOTP Token Vulnerability

MODERATE
Advisory Identifier: GHSA-wmx7-pw49-88jx
Share
CVSS 4.8
CWE-287
Published
Advisory Summary

CVE-2024-41800 is a MODERATE (CVSS 4.8) craft cms allows totp token vulnerability (CWE-287: Improper Authentication) affecting Craftcms/cms libraries in the Packagist ecosystem. The issue involves craft cms allows totp token to stay valid after use. Remediation is available by upgrading affected packages to version 5.2.3.

CVE-2024-41800 at a Glance

CVE Identifier CVE-2024-41800
GHSA Identifier GHSA-wmx7-pw49-88jx
Severity MODERATE
CVSS v3.1 Base Score 4.8
CWE Classification CWE-287: Improper Authentication
Affected Product Craftcms/cms
Package Ecosystem Packagist
Published Date
Last Updated

Security Impact

CVSS: 4.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N).

Attack Vector Network (AV:N)
Attack Complexity High (AC:H)
Privileges Required Low (PR:L)
User Interaction Required (UI:R)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity High (I:H)
Availability None (A:N)

How to Fix CVE-2024-41800

To remediate this vulnerability, upgrade all affected Craftcms/cms dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

craftcms/cms fixed: 5.2.3 
Upgrade craftcms/cms to 5.2.3
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for craftcms/cms

How to Check if You Are Affected

To determine whether your application is affected by CVE-2024-41800, inspect your project dependencies for Craftcms/cms:

inspect dependencies for craftcms/cms

Analyze the terminal output to locate any version of Craftcms/cms in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 5.2.3), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-287: Improper Authentication, where when an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. In Craftcms/cms, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. ### Impact An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. A TOTP token can be used multiple times to establish an authenticated session. [RFC 6238](https://www.rfc-editor.org/rfc/rfc6238) insists that an OTP must not be used more than once. > The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP. The OWASP Application Security Verification Standard v4.0.3 (ASVS) [reiterates this property with requirement 2.8.4](https://github.com/OWASP/ASVS/blob/v4.0.3/4.0/en/0x11-V2-Authentication.md#v28-one-time-verifier). > Verify that time-based OTP can be used only once within the validity period. It should also be noted that the validity period of an TOTP token is 2 minutes. This makes a successful brute force attack more likely, since the four tokens are valid at the same time. ### Patches This has been patched in Craft 5.2.3. References: https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV 2024061701_CraftCMS_TOTP_Valid_After_Use https://github.com/craftcms/cms/releases/tag/5.2.3

CVE-2024-41800 Affected Craftcms/cms Versions

1 component(s)
Fixed Versions:
5.2.3
Product / Package Ecosystem Affected Versions Fixed Version
craftcms/cms
 Packagist
≥ 5.0.0-beta.1
< 5.2.3
5.2.3

References

GitHub Advisory / Wiki ADVISORY
https://github.com/craftcms/cms/security/advisories/GHSA-wmx7-pw49-88jx
NVD — CVE-2024-41800 NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-41800
Security Fix Commit FIX COMMIT
https://github.com/craftcms/cms/commit/7c790fa5ad5a8cb8016cb6793ec3554c4c079e38
Craftcms/cms Source Repository REPOSITORY
https://github.com/craftcms/cms
Craftcms/cms Release RELEASE
https://github.com/craftcms/cms/releases/tag/5.2.3
GitHub Advisory / Wiki ADVISORY
https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240617-01_CraftCMS_TOTP_Valid_After_Use

Frequently Asked Questions

What is CVE-2024-41800?
CVE-2024-41800 is a security vulnerability in Craftcms/cms involving Craft CMS Allows TOTP Token To Stay Valid After Use under CWE-287: Improper Authentication.
Which Craftcms/cms versions are affected?
Affected versions include releases prior to 5.2.3 across affected packages: craftcms/cms.
What version fixes CVE-2024-41800?
Upgrading to 5.2.3 (or the latest patched release for your respective branch) resolves the vulnerability.
Is craftcms/cms affected?
Yes, craftcms/cms is affected in releases prior to 5.2.3. Upgrade your dependency to 5.2.3 or later.
What is the CVSS score of CVE-2024-41800?
CVE-2024-41800 has a CVSS v3.1 base score of 4.8 (MODERATE) with vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N.
What CWE is associated with CVE-2024-41800?
CVE-2024-41800 is classified under CWE-287: Improper Authentication (When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.).
How can I check Packagist dependencies for CVE-2024-41800?
Run the dependency tree command: 'inspect dependencies for craftcms/cms'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-wmx7-pw49-88jx",
  "modified" : "2024-07-26T21:40:26Z",
  "published" : "2024-07-25T17:58:01Z",
  "aliases" : [ "CVE-2024-41800" ],
  "summary" : "Craft CMS Allows TOTP Token To Stay Valid After Use",
  "details" : "Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period.\n\n### Impact\n\nAn attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials.\n\nA TOTP token can be used multiple times to establish an authenticated session.\n[RFC 6238](https://www.rfc-editor.org/rfc/rfc6238) insists that an OTP must not be used more than once.\n\n> The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP.\n\nThe OWASP Application Security Verification Standard v4.0.3 (ASVS) [reiterates\nthis property with requirement 2.8.4](https://github.com/OWASP/ASVS/blob/v4.0.3/4.0/en/0x11-V2-Authentication.md#v28-one-time-verifier).\n\n> Verify that time-based OTP can be used only once within the validity period.\n\nIt should also be noted that the validity period of an TOTP token is 2 minutes. This makes a successful brute force attack more likely, since the four tokens are valid at the same time.\n\n### Patches\n\nThis has been patched in Craft 5.2.3.\n\nReferences:\n\nhttps://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV 2024061701_CraftCMS_TOTP_Valid_After_Use\n\nhttps://github.com/craftcms/cms/releases/tag/5.2.3",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "craftcms/cms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.0.0-beta.1"
      }, {
        "fixed" : "5.2.3"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.2.2"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/cms/security/advisories/GHSA-wmx7-pw49-88jx"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-41800"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/cms/commit/7c790fa5ad5a8cb8016cb6793ec3554c4c079e38"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/craftcms/cms"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/cms/releases/tag/5.2.3"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240617-01_CraftCMS_TOTP_Valid_After_Use"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-287" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-07-25T17:58:01Z",
    "nvd_published_at" : "2024-07-25T17:15:11Z"
  }
}