CVE-2022-45168
📋 TL;DR
This vulnerability allows attackers to bypass two-factor authentication in LIVEBOX Collaboration vDesk by generating backup codes before TOTP verification. It affects all users of vDesk through version v018 who rely on 2FA for secure access.
💻 Affected Systems
- LIVEBOX Collaboration vDesk
📦 What is this software?
Vdesk by Liveboxcloud
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover of any user with 2FA enabled, leading to unauthorized access to collaboration data, sensitive communications, and potential lateral movement within the organization.
Likely Case
Targeted attackers bypass 2FA for specific high-value accounts to access sensitive collaboration data and communications.
If Mitigated
Limited impact if proper network segmentation, monitoring, and additional authentication layers are in place.
🎯 Exploit Status
Exploitation requires valid user credentials but bypasses the 2FA requirement. Attack chain is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v019 or later
Vendor Advisory: https://www.gruppotim.it/it/footer/red-team.html
Restart Required: Yes
Instructions:
1. Download v019+ from vendor portal
2. Backup current configuration
3. Apply patch/upgrade
4. Restart vDesk services
5. Verify 2FA flow requires TOTP before backup code generation
🔧 Temporary Workarounds
Disable backup code functionality
allTemporarily disable backup code generation to prevent exploitation
Modify vDesk configuration to remove /login/backup_code and /api/v1/vdeskintegration/createbackupcodes endpoints
Implement WAF rules
allBlock requests to vulnerable endpoints at network perimeter
Add WAF rules to block POST requests to /login/backup_code and /api/v1/vdeskintegration/createbackupcodes
🧯 If You Can't Patch
- Implement strict network segmentation to limit vDesk access to trusted IPs only
- Enable detailed authentication logging and monitor for unusual backup code generation patterns
🔍 How to Verify
Check if Vulnerable:
Test if backup codes can be generated via API before completing TOTP verification during loginCheck Version:
Check vDesk admin interface or configuration files for version numberVerify Fix Applied:
Verify that backup code generation endpoints now require successful TOTP verification first📡 Detection & Monitoring
Log Indicators:
- Multiple backup code generation attempts for single user
- Backup code generation without preceding successful TOTP verification
Network Indicators:
- HTTP POST requests to vulnerable endpoints from unusual IPs
- Rapid authentication attempts with backup codes
SIEM Query:
source="vdesk" AND (uri_path="/login/backup_code" OR uri_path="/api/v1/vdeskintegration/createbackupcodes") AND NOT (preceding_event="totp_verified")