-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pterodactyl/panel | composer | < 1.12.0 | 1.12.0 |
Miggo AIRoot Cause AnalysisThe vulnerability allows for the reuse of a Time-based One-Time Password (TOTP) within its short validity window, undermining the security of two-factor authentication. The analysis of the patch commit 032bf076d92bb2f929fa69c1bac1b89f26b8badf reveals that the weakness was located in the __invoke method of the LoginCheckpointController. This controller is responsible for verifying the 2FA token after a user has provided their primary credentials. The original code only validated the token's correctness for the current time, without invalidating it upon use. The fix involves storing the timestamp of the last successful TOTP authentication and checking against it on subsequent login attempts using the verifyKeyNewer function. This ensures that each token can be used only once. Therefore, the Pterodactyl\Http\Controllers\Auth\LoginCheckpointController::__invoke function is the precise location of the vulnerability.
Pterodactyl\Http\Controllers\Auth\LoginCheckpointController::__invokeapp/Http/Controllers/Auth/LoginCheckpointController.php