SpongePowered / LegacySpongeAuth

An authentication portal for shared user accounts between Sponge services.
4 stars 3 forks source link

Minorish: TOTP allows replays and shouldn't #11

Closed lol768 closed 7 years ago

lol768 commented 7 years ago

The 2FA code verification does not store successfully used one-time passwords, and allows them to be used multiple times.

Steps to reproduce:


This is minor because intercepting the 2FA code is not straightforward. The site uses TLS and HSTS which makes performing a MitM difficult (assuming CAs do their job properly). Main threat model here is a (potentially hardware-based) key logger (where we will get username, password and TOTP but not the session cookie). With Auth in its current state it's possible to take over an account by reusing a code that should've been invalidated with this information.