Improper Restriction of Excessive Authentication Attempts The advisory has been revoked - it doesn't affect any version of package devise-two-factor Open this link in a new tab

This was deemed not a vulnerability.

Affected versions of this package are vulnerable to Improper Restriction of Excessive Authentication Attempts due to the lack of an account lockout mechanism. When combined with the Time-based One Time Password algorithm's (TOTP) inherent entropy limitations, an attacker can bypass the two-factor authentication protection by performing a brute-force attack.

Notes:

The attacker needs access to a user's username and password to exploit this vulnerability.

The user under attack would not necessarily know that their account has been compromised.

The maintainers will not release any fixes for this vulnerability. This library is open-ended by design and cannot solve this for all applications natively. It's recommended that any application leveraging Devise-Two-Factor implement controls at the application level to mitigate this threat.

1. Use the lockable strategy from Devise to lock a user after a certain number of failed login attempts. See https://www.rubydoc.info/github/heartcombo/devise/main/Devise/Models/Lockable for more information.

2. Configure a rate limit for your application, especially on the endpoints used to log in. One such library to accomplish this is rack-attack.

3. When displaying authentication errors hide whether validating a username/password combination failed or a two-factor code failed behind a more generic error message.

Note: The CVE for this issue has been withdrawn and the project maintainers have clarified the expected behavior of the package and the ways to use it securely, given the attack vector described here.

• GitHub Advisory