CVE-2024-5658
📋 TL;DR
This vulnerability in the CraftCMS Two-Factor Authentication plugin allows attackers to reuse TOTP tokens multiple times within their validity period, bypassing the intended one-time use protection. It affects CraftCMS websites using the vulnerable plugin version. This weakens two-factor authentication security for all users of affected systems.
💻 Affected Systems
- CraftCMS Two-Factor Authentication plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete bypass of two-factor authentication for all users, allowing unauthorized account access even with stolen credentials.
Likely Case
Targeted account takeover for specific users if attackers obtain valid TOTP tokens through phishing or other means.
If Mitigated
Limited impact if strong password policies and account lockouts are in place, but 2FA protection is still weakened.
🎯 Exploit Status
Exploitation requires obtaining a valid TOTP token through phishing, man-in-the-middle, or other credential theft methods.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.4
Vendor Advisory: https://github.com/born05/craft-twofactorauthentication/releases/tag/3.3.4
Restart Required: No
Instructions:
1. Backup your CraftCMS installation. 2. Update the Two-Factor Authentication plugin to version 3.3.4 via CraftCMS control panel or Composer. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Disable Two-Factor Authentication Plugin
allTemporarily disable the vulnerable plugin until patching is possible
Implement Rate Limiting
allAdd rate limiting to authentication endpoints to limit token reuse attempts
🧯 If You Can't Patch
- Monitor authentication logs for suspicious patterns of token reuse
- Implement additional authentication factors beyond TOTP
🔍 How to Verify
Check if Vulnerable:
Check plugin version in CraftCMS admin panel under Settings → PluginsCheck Version:
Check CraftCMS admin panel or composer show born05/craft-twofactorauthenticationVerify Fix Applied:
Confirm plugin version shows 3.3.4 or higher in CraftCMS admin📡 Detection & Monitoring
Log Indicators:
- Multiple successful logins with same TOTP token
- Rapid authentication attempts from single source
Network Indicators:
- Unusual authentication traffic patterns
SIEM Query:
source="craftcms" AND (event="authentication" AND token_reuse=true) OR (event="login" AND count>1 within 30s)🔗 References
- http://www.openwall.com/lists/oss-security/2024/06/06/2
- https://github.com/born05/craft-twofactorauthentication/releases/tag/3.3.4
- https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-02_CraftCMS_Plugin_Two-Factor_Authentication_TOTP_Valid_After_Use
- https://plugins.craftcms.com/two-factor-authentication?craft4
- http://www.openwall.com/lists/oss-security/2024/06/06/2
- https://github.com/born05/craft-twofactorauthentication/releases/tag/3.3.4
- https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-02_CraftCMS_Plugin_Two-Factor_Authentication_TOTP_Valid_After_Use
- https://plugins.craftcms.com/two-factor-authentication?craft4
