CVE-2021-21329
📋 TL;DR
This vulnerability allows users with multi-factor authentication (MFA) enabled to bypass the token verification process and log in without a valid second factor. It affects RATCF (RACTF) installations where MFA is configured. The flaw undermines the security of MFA-protected accounts.
💻 Affected Systems
- RATCF (RACTF)
📦 What is this software?
Ratcf by Ratcf
⚠️ Risk & Real-World Impact
Worst Case
Attackers could gain unauthorized access to MFA-protected administrative accounts, potentially compromising the entire CTF platform, stealing sensitive data, or manipulating competition results.
Likely Case
Unauthorized users bypass MFA to access other users' accounts, leading to privilege escalation, data theft, or disruption of CTF events.
If Mitigated
With proper network segmentation and monitoring, impact is limited to unauthorized access to individual user accounts within the CTF platform.
🎯 Exploit Status
Exploitation requires valid user credentials but bypasses MFA token verification. The vulnerability is in authentication logic, making exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit cebb67b or later
Vendor Advisory: https://github.com/ractf/core/security/advisories/GHSA-fw57-f7mq-9q85
Restart Required: Yes
Instructions:
1. Update RATCF to commit cebb67b or later. 2. Restart the RATCF application/service. 3. Verify MFA functionality is working correctly.
🔧 Temporary Workarounds
Disable MFA
allTemporarily disable multi-factor authentication for all users to prevent the bypass vulnerability.
# Modify RATCF configuration to disable MFA features
🧯 If You Can't Patch
- Implement network-level access controls to restrict RATCF access to trusted users only.
- Enable detailed authentication logging and monitor for suspicious login attempts without MFA verification.
🔍 How to Verify
Check if Vulnerable:
Check if your RATCF version is older than commit cebb67b and MFA is enabled. Test by attempting to log in with MFA-enabled account using invalid token.Check Version:
git log --oneline -1Verify Fix Applied:
After updating, test MFA functionality by verifying login requires valid token for MFA-enabled accounts.📡 Detection & Monitoring
Log Indicators:
- Successful logins for MFA-enabled accounts without corresponding MFA verification events
- Multiple failed MFA attempts followed by successful login
Network Indicators:
- Unusual authentication patterns from single IP addresses
SIEM Query:
source="ractf.log" (event="login_success" AND user="*" AND NOT event="mfa_verified")🔗 References
- https://github.com/ractf/core/commit/c57a4d186bfc586ad3edfe4dcba9f11efbf22f09#diff-60c444c47c061306f2dff5bf97c07810f40f949a8e94ecbb609b6b29364c8642R130-R152
- https://github.com/ractf/core/commit/cebb67bd16a8296121201805332365ffccb29638
- https://github.com/ractf/core/security/advisories/GHSA-fw57-f7mq-9q85
- https://github.com/ractf/core/commit/c57a4d186bfc586ad3edfe4dcba9f11efbf22f09#diff-60c444c47c061306f2dff5bf97c07810f40f949a8e94ecbb609b6b29364c8642R130-R152
- https://github.com/ractf/core/commit/cebb67bd16a8296121201805332365ffccb29638
- https://github.com/ractf/core/security/advisories/GHSA-fw57-f7mq-9q85
