CVE-2022-45173
📋 TL;DR
This vulnerability allows attackers to bypass two-factor authentication in LIVEBOX Collaboration vDesk by manipulating client-side verification of TOTP challenges. Attackers can modify API responses to trick the application into accepting invalid authentication codes. This affects all users of vDesk through version v018.
💻 Affected Systems
- LIVEBOX Collaboration vDesk
📦 What is this software?
Vdesk by Liveboxcloud
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover leading to unauthorized access to collaboration systems, data exfiltration, and lateral movement within the network.
Likely Case
Unauthorized access to user accounts, potential data theft, and privilege escalation within the vDesk platform.
If Mitigated
Limited impact if strong network segmentation, monitoring, and additional authentication layers are in place.
🎯 Exploit Status
Exploitation requires network access to the API endpoint and ability to intercept/modify HTTP responses.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v019 or later
Vendor Advisory: https://www.gruppotim.it/it/footer/red-team.html
Restart Required: Yes
Instructions:
1. Contact LIVEBOX Collaboration support for patch v019 or later. 2. Backup current configuration. 3. Apply the update following vendor instructions. 4. Restart the vDesk service. 5. Verify the fix by testing 2FA functionality.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to the vulnerable API endpoint using firewall rules
iptables -A INPUT -p tcp --dport [vDesk-port] -s [trusted-networks] -j ACCEPT
iptables -A INPUT -p tcp --dport [vDesk-port] -j DROP
Web Application Firewall
allImplement WAF rules to detect and block manipulation of /api/v1/vdeskintegration/challenge responses
🧯 If You Can't Patch
- Implement network-level monitoring for suspicious API requests to the challenge endpoint
- Enforce additional authentication factors beyond the vulnerable 2FA implementation
🔍 How to Verify
Check if Vulnerable:
Check if API endpoint /api/v1/vdeskintegration/challenge exists and returns client-verifiable TOTP responsesCheck Version:
Check vDesk admin interface or contact vendor for version informationVerify Fix Applied:
Test 2FA functionality with invalid codes - they should be rejected server-side📡 Detection & Monitoring
Log Indicators:
- Multiple failed 2FA attempts followed by successful login from same IP
- Unusual API requests to /api/v1/vdeskintegration/challenge
Network Indicators:
- Manipulated HTTP responses to challenge endpoint
- Unusual traffic patterns to authentication APIs
SIEM Query:
source="vdesk-logs" AND (uri="/api/v1/vdeskintegration/challenge" OR event="2fa_bypass")