CWE-654
Reliance on a Single Factor in a Security Decision
A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.
CVE-2024-24771 (GCVE-0-2024-24771)
Vulnerability from cvelistv5
| ► | URL | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
| Vendor | Product | Version | ||
|---|---|---|---|---|
| open-formulieren | open-forms |
Version: < 2.2.9 Version: >= 2.3.0, < 2.3.7 Version: >= 2.4.0, < 2.4.4 Version: >= 2.5.0, < 2.5.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-24771",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-07T19:33:10.005162Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T17:21:41.057Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:28:12.208Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/open-formulieren/open-forms/security/advisories/GHSA-64r3-x3gf-vp63",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/open-formulieren/open-forms/security/advisories/GHSA-64r3-x3gf-vp63"
},
{
"name": "https://github.com/open-formulieren/open-forms/releases/tag/2.2.9",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/open-formulieren/open-forms/releases/tag/2.2.9"
},
{
"name": "https://github.com/open-formulieren/open-forms/releases/tag/2.3.7",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/open-formulieren/open-forms/releases/tag/2.3.7"
},
{
"name": "https://github.com/open-formulieren/open-forms/releases/tag/2.4.5",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/open-formulieren/open-forms/releases/tag/2.4.5"
},
{
"name": "https://github.com/open-formulieren/open-forms/releases/tag/2.5.2",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/open-formulieren/open-forms/releases/tag/2.5.2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "open-forms",
"vendor": "open-formulieren",
"versions": [
{
"status": "affected",
"version": "\u003c 2.2.9"
},
{
"status": "affected",
"version": "\u003e= 2.3.0, \u003c 2.3.7"
},
{
"status": "affected",
"version": "\u003e= 2.4.0, \u003c 2.4.4"
},
{
"status": "affected",
"version": "\u003e= 2.5.0, \u003c 2.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-factor authentication weakness. Superusers who have their credentials (username + password) compromised could potentially have the second-factor authentication bypassed if an attacker somehow managed to authenticate to Open Forms. The maintainers of Open Forms do not believe it is or has been possible to perform this login. However, if this were possible, the victim\u0027s account may be abused to view (potentially sensitive) submission data or have been used to impersonate other staff accounts to view and/or modify data. Three mitigating factors to help prevent exploitation include: the usual login page (at `/admin/login/`) does not fully log in the user until the second factor was succesfully provided; the additional non-MFA protected login page at `/api/v2/api-authlogin/` was misconfigured and could not be used to log in; and there are no additional ways to log in. This also requires credentials of a superuser to be compromised to be exploitable. Versions 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain the following patches to address these weaknesses: Move and only enable the API auth endpoints (`/api/v2/api-auth/login/`) with `settings.DEBUG = True`. `settings.DEBUG = True` is insecure and should never be applied in production settings. Additionally, apply a custom permission check to the hijack flow to only allow second-factor-verified superusers to perform user hijacking."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-654",
"description": "CWE-654: Reliance on a Single Factor in a Security Decision",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-07T14:51:10.303Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/open-formulieren/open-forms/security/advisories/GHSA-64r3-x3gf-vp63",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/open-formulieren/open-forms/security/advisories/GHSA-64r3-x3gf-vp63"
},
{
"name": "https://github.com/open-formulieren/open-forms/releases/tag/2.2.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-formulieren/open-forms/releases/tag/2.2.9"
},
{
"name": "https://github.com/open-formulieren/open-forms/releases/tag/2.3.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-formulieren/open-forms/releases/tag/2.3.7"
},
{
"name": "https://github.com/open-formulieren/open-forms/releases/tag/2.4.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-formulieren/open-forms/releases/tag/2.4.5"
},
{
"name": "https://github.com/open-formulieren/open-forms/releases/tag/2.5.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-formulieren/open-forms/releases/tag/2.5.2"
}
],
"source": {
"advisory": "GHSA-64r3-x3gf-vp63",
"discovery": "UNKNOWN"
},
"title": "Open Forms potential multi-factor authentication bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-24771",
"datePublished": "2024-02-07T14:51:10.303Z",
"dateReserved": "2024-01-29T20:51:26.013Z",
"dateUpdated": "2024-08-01T23:28:12.208Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation
Phase: Architecture and Design
Description:
- Use multiple simultaneous checks before granting access to critical operations or granting critical privileges. A weaker but helpful mitigation is to use several successive checks (multiple layers of security).
Mitigation
Phase: Architecture and Design
Description:
- Use redundant access rules on different choke points (e.g., firewalls).
CAPEC-16: Dictionary-based Password Attack
["An attacker tries each of the words in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user was a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern.", "Dictionary Attacks differ from similar attacks such as Password Spraying (CAPEC-565) and Credential Stuffing (CAPEC-600), since they leverage unknown username/password combinations and don't care about inducing account lockouts."]
CAPEC-274: HTTP Verb Tampering
An attacker modifies the HTTP Verb (e.g. GET, PUT, TRACE, etc.) in order to bypass access restrictions. Some web environments allow administrators to restrict access based on the HTTP Verb used with requests. However, attackers can often provide a different HTTP Verb, or even provide a random string as a verb in order to bypass these protections. This allows the attacker to access data that should otherwise be protected.
CAPEC-49: Password Brute Forcing
An adversary tries every possible value for a password until they succeed. A brute force attack, if feasible computationally, will always be successful because it will essentially go through all possible passwords given the alphabet used (lower case letters, upper case letters, numbers, symbols, etc.) and the maximum length of the password.
CAPEC-55: Rainbow Table Password Cracking
An attacker gets access to the database table where hashes of passwords are stored. They then use a rainbow table of pre-computed hash chains to attempt to look up the original password. Once the original password corresponding to the hash is obtained, the attacker uses the original password to gain access to the system.
CAPEC-560: Use of Known Domain Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate credentials (e.g. userID/password) to achieve authentication and to perform authorized actions under the guise of an authenticated user or service.
CAPEC-565: Password Spraying
In a Password Spraying attack, an adversary tries a small list (e.g. 3-5) of common or expected passwords, often matching the target's complexity policy, against a known list of user accounts to gain valid credentials. The adversary tries a particular password for each user account, before moving onto the next password in the list. This approach assists the adversary in remaining undetected by avoiding rapid or frequent account lockouts. The adversary may then reattempt the process with additional passwords, once enough time has passed to prevent inducing a lockout.
CAPEC-600: Credential Stuffing
An adversary tries known username/password combinations against different systems, applications, or services to gain additional authenticated access. Credential Stuffing attacks rely upon the fact that many users leverage the same username/password combination for multiple systems, applications, and services.
CAPEC-652: Use of Known Kerberos Credentials
An adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or services within the domain.
CAPEC-653: Use of Known Operating System Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate operating system credentials (e.g. userID/password) to achieve authentication and to perform authorized actions on the system, under the guise of an authenticated user or service. This applies to any Operating System.
CAPEC-70: Try Common or Default Usernames and Passwords
An adversary may try certain common or default usernames and passwords to gain access into the system and perform unauthorized actions. An adversary may try an intelligent brute force using empty passwords, known vendor default credentials, as well as a dictionary of common usernames and passwords. Many vendor products come preconfigured with default (and thus well-known) usernames and passwords that should be deleted prior to usage in a production environment. It is a common mistake to forget to remove these default login credentials. Another problem is that users would pick very simple (common) passwords (e.g. "secret" or "password") that make it easier for the attacker to gain access to the system compared to using a brute force attack or even a dictionary attack using a full dictionary.