CVE-2015-7225: OTP reuse in Devise-Two-Factor

by Justin Bull

TL;DR: Once a user successfully provides a valid OTP, that OTP can be replayed for the duration of the timestep. Upgrade to version 2.0.0 or higher.

The Problem

Devise-Two-Factor implements RFC 6238 which defines a way to provide what is commonly known as Two-Factor Authentication (2FA).

RFC 6238 states that once a valid OTP is successfully proven to the server, the server must reject all subsequent validation attempts of that OTP for a given timestep. In other words, as the name implies, the OTP can only be used once.

Devise-Two-Factor failed to "burn" a given OTP code once validated successfully.

The Impact

Despite violating a security design concern in the RFC, the impact is quite small.

  1. Attacker has a window of opportunity of the timestep (30 seconds by default)
  2. Attacker must shoulder-surf or MiTM the OTP code.
  3. Attacker must already know the victim's password.

Satisfying these conditions will defeat two-factor authentication for the victim, in that one authentication scenario.

However, the Man-in-The-Middles (MiTM) scenario is moot since, if an attacker can MiTM the

connection, they can just obtain the granted session secret from the response instead.

Solution

Because the server (aka verifier) must now "remember" which tokens are valid and which are not, a storage mechanism must be used. Caches are a pallatable solution but permenant storage is desired.

In the case of Devise-Two-Factor, the verifier simply writes down the last successful OTP code. When a prover supplies an OTP, the verifier does two things:

  1. Checks if the given code is valid for the given timestep
  2. Checks if the given code is not the same as the previous successful OTP code

If both conditions pass then the user (prover) is valid and should be issued an authentication token.

The supplied code will never* match the previously stored value unless its two attempts in the same timestep (aka our replay attack).

*there is a tiny chance that a future timestep will produce the same code because of the pigeonhole principle. In which case the prover (user) will receive a false-positive error. Trying again in a T+1 timestep will resolve the issue. Because this probability is so slim (I think 1 in a million), it's considered "never to occur".

Patch/Workaround

Specifically to Devise-Two-Factor, the patch is here: https://github.com/tinfoil/devise-two-factor/commit/cb025fbd7fd257a057dd82de50aead7fbc987e8f

Applicable to Other Libraries

It is extremely likely Devise-Two-Factor is not the only library implementing TOTPs incorrectly, failing to guard replayed OTP codes. Checking other libraries in various languages would likely expose the same exploit.

Acknowledgements

Thanks to Viliam Holub for originally reporting the issue.

Header image is by Brent Moore under the Creative Commons license CC BY-NC 2.0.