What You Need to Know
Short Description
An issue with the LinOTP 3 Self Service login's request context safety mechanism can cause a user's session data to be mistakenly replaced with that of another user who is logged in at the same time. This error could potentially reveal personal information (like username, email, and phone number) and allow one user to access and operate with the permissions of another within the LinOTP 3 Self Service.
Affected Products
- LinOTP 3 with all versions from LinOTP 3.0 up to LinOTP 3.2.4
- LinOTP Virtual Appliance with LinOTP 3.0 and above (Installations based on SVA 3.0 and higher need to update to LinOTP 3.2.5 and newer)
Unaffected Products
- LinOTP 2 up to and including the current 2.12.6 is not affected.
- LinOTP ADFS Plugin is not affected
- LinOTP LAP is not affected
- LinOTP SAML IdP, LinOTP RADIUS Authentication Module, LinOTP LDAP Authentication Module are not affected.
- LinOTP Virtual Appliance itself is not affected.
Criticality
We are currently calculating with a CVSS 3.1 score of 7.5 (high)
(CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C/CR:M/IR:M/AR:M).
CVE-2023-49706 was published for this vulnerability.
Date of Publication
2023-12-19
Disclaimer:LinOTP core authentication checks are not directly affected. The validation of logins using the LinOTP core API, including all LinOTP Authentication Modules are not directly affected. This includes all protocols (SAML, RADIUS, LDAP, ), and authentication frontends (i.e. LinOTP Authentication Provider, ADFS) which are not directly affected by this advisory.
Description
Due to an error in the multi-threading safety mechanism in the LinOTP 3 Self Service login, the session check data of a user can be overwritten with the session data of another, concurrent user. This leads to possible information disclosure (username, e-mail, phone number) and allows to act as and with the permissions of the attacked user in the LinOTP 3 Self Service.
This vulnerability could enable unauthorized access without the need for valid credentials. In specific situations, it might be possible to target an individual user. However, any unauthorized access attempts by a malicious entity would only be possible if another user is actively engaged in the self-service portal at the same time. It is important to note that previously expired sessions cannot be exploited in this context.
We currently have no evidence indicating that the identified vulnerability has been exploited.
A customer initially reported a display bug with the Self Service. After further investigations, the LinOTP team was able to identify a related vulnerability and assess its severity. We developed a fix while analyzing the behavior which is provided with this update. Other parts of LinOTP beyond the Self Service were analyzed. No additional occurrence of this implementation pattern was found. The administrative login implemented with LinOTP 3 is not affected.
The provided update to LinOTP 3.2.5 completely fixes this vulnerability. All customers running LinOTP 3 up to version 3.2.4 are strongly advised to install the newest version LinOTP 3.2.5 as soon as possible.
We are providing LinOTP 3.2.5 as a regular update for LinOTP SVA and as native packages for LinOTP 3.2.4 and older (Debian). Please refer to the installation instructions for the correct steps in your environment: Installation Instructions
Customers can contact support@linotp.de if you have any questions about the update. We are happy to assist directly and execute the update together with you, tailored to your environment.
Preventive actions
A complete fix of the vulnerability needs the installation of the provided update. If you can not install the update in a fitting time frame we provide some preventive actions.
Deactivating all active policies in the scope „selfservice“ will remove all permissions for all users. This will prevent a possible misuse until the update can be installed. Please note, regular users will also not be able to configure their tokens, until the policies are reactivated.
Deactivating the „userservice“ backend and the Self Service completely is advised if you cannot update for some time. Please contact support@linotp.de, we are happy to assist in deactivating the backend in the LinOTP configuration.
Important Measures
LinOTP 3 Self Service checks the user and the client IP of the session. A common scenario for LinOTP 3 Self Service is running a proxy or load balancer between the client and the LinOTP backend. Oversight to configure the forwarding of the client IP to LinOTP in this scenario, increases the possibility of the race condition in this advisory to occur, since the clients IP is not contributing to distinguish the session. Please refer to 1.12.4. System Config — LinOTP 3.2 documentation for details. This is independent of the current update.
We understand that this process may be inconvenient, and our technical support team is here to assist our customers.