Time-Based One-Time Password (TOTP) Reuse Affecting devise-two-factor Open this link in a new tab package, versions < 2.0.0
Attack Complexity
High
Confidentiality
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-RUBY-DEVISETWOFACTOR-20239
-
published
16 Sep 2015
-
disclosed
16 Sep 2015
-
credit
Viliam Holub
Introduced: 16 Sep 2015
CVE-2015-7225 Open this link in a new tabOverview
devise-two-factor is a two-factor authentication addition to devise.
Affected versions do not mark used TOTP (Time-Based One-Time Password) verification codes once used, and allow their reuse during the timestep period of the code. This can be exploited by an attacker with knowledge of the authentication credentials AND access to the TOTP verification code that was just used.