Compliance Impact

I don't know

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious security impacts if you use OneUptime with WebAuthn 2FA enabled. An attacker who obtains your password and a single valid WebAuthn assertion can bypass the second-factor authentication indefinitely by replaying the captured assertion.

• Attackers can gain unauthorized access to your account without possessing your physical authenticator device.
• The vulnerability can be exploited through techniques such as stored XSS, man-in-the-middle attacks, or log exposure to capture valid authentication assertions.
• This effectively renders the WebAuthn 2FA protection useless, increasing the risk of account compromise.

The vulnerability has a high severity rating with a CVSS v3 score of 8.2, indicating significant confidentiality and integrity impacts.

Useful 0 Not Useful 0

Executive Summary

This vulnerability affects the WebAuthn two-factor authentication (2FA) implementation in OneUptime versions 10.0.11 and earlier. The core issue is that the server does not store the WebAuthn challenge it generates during authentication. Instead, it returns the challenge to the client and later accepts the same challenge back from the client during verification.

This behavior violates the WebAuthn specification and allows an attacker who has obtained a valid WebAuthn assertion (for example, through cross-site scripting (XSS), man-in-the-middle (MitM) attacks, or log exposure) to replay that assertion indefinitely. As a result, the attacker can bypass the second-factor authentication completely without needing the victim’s authenticator device.

The vulnerability arises because the server uses the client-supplied challenge as the expected challenge during verification, which always matches the challenge embedded in the captured assertion, making the cryptographic signature valid and enabling replay attacks.

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring authentication requests for replayed WebAuthn assertions. Since the server does not store the challenge and accepts the challenge value from the client, repeated identical authentication requests containing the same WebAuthn assertion indicate exploitation attempts.'}, {'type': 'paragraph', 'content': 'To detect such activity on your system or network, you can analyze logs or capture network traffic to identify repeated WebAuthn authentication requests with identical challenge and credential data.'}, {'type': 'paragraph', 'content': 'Suggested commands include using network packet capture tools like tcpdump or Wireshark to filter WebAuthn authentication traffic, for example:'}, {'type': 'list_item', 'content': "tcpdump -i <interface> -A -s 0 'tcp port 443' | grep -i 'challenge'"}, {'type': 'list_item', 'content': "Use grep or similar tools on server logs to find repeated authentication requests with identical challenge values, e.g., grep 'challenge' /path/to/authentication/logs | sort | uniq -c | sort -nr"}, {'type': 'paragraph', 'content': 'Additionally, monitoring for unusual authentication patterns such as multiple successful logins using the same WebAuthn assertion or repeated authentication attempts from the same client data can help identify exploitation.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include implementing server-side storage of the WebAuthn challenge value generated during authentication and verifying the client response against this stored challenge to prevent replay attacks.

Since no patches are currently available, you should consider the following actions:

• Disable WebAuthn-based two-factor authentication temporarily to prevent exploitation.
• Implement additional monitoring and rate limiting on authentication endpoints to reduce the risk of replay attacks.
• Review and fix any cross-site scripting (XSS) vulnerabilities or other attack vectors that could allow an attacker to capture valid WebAuthn assertions.
• Educate users about the risk and encourage strong password use and other security best practices until a patch is released.

Useful 0 Not Useful 0