CVE-2015-7225 Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)
MediumCVSS 5.3
EPSS 2.1%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or shoulder surfing, and replaying the OTP in the current time-step.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems devise-two-factor(RubyGems) | < 2.0.0 | 2.0.0 |
| rubygems devise-two-factor(RubyGems) | = 1.0.0 | No fix listed |
| rubygems devise-two-factor(RubyGems) | = 1.0.1 | No fix listed |
| rubygems devise-two-factor(RubyGems) | = 1.0.2 | No fix listed |
| rubygems devise-two-factor(RubyGems) | = 1.1.0 | No fix listed |
| debian/ruby-devise-two-factor(Debian:12) | < 2.0.0-1 | 2.0.0-1 |
| tinfoilsecurity devise-two-factor | <= 1.1.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com third-party-advisory
- bugs.debian.org mailing-list third-party-advisory
- github.com vendor-advisory
- github.com third-party-advisory
- [oss-sercurity] 20150620 CVE Request: MITM & Shoulder-surfing vuln in Ruby OTP/HOTP/TOTP library "ROPT" mailing-list vdb-entry
- [oss-security] 20150917 Re: CVE Request: TOTP Replay Attack in Ruby library mailing-list vdb-entry
- github.com exploit
- www.openwall.com
- web.archive.org
- github.com product
- Debian Security Tracker CVE-2015-7225 vendor-advisory
- 76789 third-party-advisory vdb-entry
- bugs.debian.org issue-tracking