Security Fix: Replay and Denial of Service vulnerability in HOTP plugin
Impacted versions
- Two-factor Authentication (TFA) 8.x-1.x versions prior to 8.x-1.6
- Two-factor Authentication (TFA) 2.x versions prior to and including 2.0.0-alpha2
Description
If an incorrect token is entered on the token validation page for a HOTP token the counter would be reset to the equivalent of counter 0.
An incorrectly synchronized token can create a DoS by preventing login if all codes are previously used. A stored counter that does not match a remote token can create an apparent DoS if it is outside the allowed counter window compared to a token actual counter.
Mitigating factors
Since 8.x-1.3 TFA will check token hashes even if the site_hash has been changed.
An attack requires a valid username/password combination to exploit either vulnerability.
The 2.x development branch has been fixed since unrelated work was committed in Switch to spomky-labs/otphp
Impact on previous announced vulnerabilities
8.x-1.3 was announced that the HOTP plugin was not vulnerable however this exploit in combination with a deployment prior to 8.x-1.3 could allow exploitation of the previously announced replay attack with HOTP tokens
Drupal Security Advisory
This issue is published without a security advisory in accordance with the precedent set in preparing the 8.x-1.3 security fix release.