-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| joomla/joomla-cms | composer | >= 5.0.0, < 5.2.6 | 5.2.6 |
| joomla/joomla-cms | composer | >= 4.0.0, < 4.4.13 | 4.4.13 |
Miggo AIRoot Cause AnalysisThe vulnerability description states 'Insufficient state checks lead to a vector that allows to bypass 2FA checks.' I analyzed the commits for the patched versions (5.2.6 and 4.4.13). Both commits (bc228bcb4cfa6d2f01e18cb4d40c13fef275dfd1 for 5.2.6 and c4044f68d7f5801c2b74e72f6e59f2652b7c4eff for 4.4.13) show identical changes in the file libraries/src/Application/MultiFactorAuthenticationHandler.php, specifically within the needsMultiFactorAuthenticationRedirection method. The patch modifies the conditions under which an MFA redirection is skipped. The removed code block represents the vulnerable logic where a simple call to $this->isMultiFactorAuthenticationPage() was used. The new code introduces a more specific check involving $this->isMultiFactorAuthenticationPending() and $isMFASetupMandatory to determine if the page is a 'captive' MFA page. This clearly indicates that the needsMultiFactorAuthenticationRedirection function contained the flawed state check that allowed the MFA bypass. During exploitation, this function would have incorrectly returned false (or allowed execution to proceed without redirection) under certain conditions, thus bypassing the MFA requirement.