-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/zitadel/zitadel/v2 | go | < 2.71.18 | 2.71.18 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the absence of a brute-force mitigation mechanism for authentication factors like passwords, OTPs, and TOTPs. The provided patch addresses this by introducing a 'tarpit' feature, which adds a delay that increases with the number of failed authentication attempts. The analysis of the patch identified the core functions responsible for verifying these authentication factors. The functions checkPassword, checkTOTP, and checkOTP in the internal/command package are the central points where these checks occur. The patch modifies these functions and their callers to include a call to the new tarpit function upon a failed attempt. Specifically, the signatures of these functions were changed to accept a tarpit function pointer. The checkCurrentPassword method, used during password changes, was also modified to incorporate this protection. The new verifyPasswordWithLockoutPolicy function encapsulates the vulnerable logic and now includes the fix. These functions would be active during any authentication attempt, and therefore, their presence in a runtime profile would indicate the execution of the vulnerable code path.
command.checkPasswordinternal/command/user_human_password.go
command.checkTOTPinternal/command/user_human_otp.go
command.checkOTPinternal/command/user_human_otp.go
command.(*Commands).checkCurrentPasswordinternal/command/user_human_password.go
command.verifyPasswordWithLockoutPolicyinternal/command/user_human_password.go
Ongoing coverage of React2Shell