CVE-2022-40722
📋 TL;DR
This vulnerability allows attackers to bypass offline multi-factor authentication (MFA) in PingID Adapter for PingFederate through pre-computed dictionary attacks targeting RSA padding misconfiguration. Organizations using PingID mobile authenticators with offline MFA enabled are affected. The bypass could allow unauthorized access to protected systems.
💻 Affected Systems
- PingID Adapter for PingFederate
📦 What is this software?
Pingfederate by Pingidentity
Pingfederate by Pingidentity
Pingid Adapter For Pingfederate by Pingidentity
⚠️ Risk & Real-World Impact
Worst Case
Complete bypass of MFA protection, allowing unauthorized users to access sensitive systems and data without proper authentication.
Likely Case
Targeted attacks against high-value accounts to bypass MFA and gain unauthorized access to enterprise systems.
If Mitigated
Limited impact with proper network segmentation and additional authentication layers, though MFA bypass remains possible.
🎯 Exploit Status
Requires ability to intercept or generate authentication attempts and perform pre-computed dictionary attacks
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: PingID Integration Kit 2.20 or later
Vendor Advisory: https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_20_rn
Restart Required: Yes
Instructions:
1. Update to PingID Integration Kit 2.20 or later. 2. Apply configuration changes per vendor documentation. 3. Restart PingFederate services. 4. Test offline MFA functionality.
🔧 Temporary Workarounds
Disable Offline MFA
allTemporarily disable offline MFA functionality until patching can be completed
Configure PingFederate to disable offline MFA in PingID adapter settings
🧯 If You Can't Patch
- Implement additional authentication controls such as IP restrictions or session timeouts
- Monitor authentication logs for unusual patterns or failed MFA attempts
🔍 How to Verify
Check if Vulnerable:
Check PingID Integration Kit version and verify if offline MFA with PingID mobile authenticators is configuredCheck Version:
Check PingFederate admin console or configuration files for PingID Integration Kit versionVerify Fix Applied:
Verify PingID Integration Kit version is 2.20 or later and test offline MFA functionality📡 Detection & Monitoring
Log Indicators:
- Multiple failed MFA attempts from same source
- Successful authentication without proper MFA sequence
- Unusual authentication patterns
Network Indicators:
- Repeated authentication requests to PingFederate endpoints
- Traffic patterns suggesting dictionary attacks
SIEM Query:
source="pingfederate" AND (event_type="authentication" AND mfa_status="bypassed" OR mfa_status="failed")🔗 References
- https://docs.pingidentity.com/r/en-us/pingid/pingid_adapter_configuring_offline_mfa
- https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_20_rn
- https://docs.pingidentity.com/r/en-us/pingid/pingid_adapter_configuring_offline_mfa
- https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_20_rn
