lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CH0PR18MB4306B9543D684C597193B7B3EF00A@CH0PR18MB4306.namprd18.prod.outlook.com>
Date: Wed, 26 Jul 2023 21:17:15 +0000
From: "Patel, Nirav" <Nirav.Patel@...owerid.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] Unauthorized MFA Code Delivery in EmpowerID

 Severity: High



Description:



An identified security flaw is present in EmpowerID versions V7.205.0.0 and prior versions, causing the system to mistakenly send Multi-Factor Authentication (MFA) codes to unintended email addresses. To exploit this vulnerability, an attacker would need to have access to valid and breached login details, including a username and password.

This vulnerability's root cause lies in insufficient verification of previously registered MFA during the process of delivering MFA codes. A bad actor possessing the correct login details for an EmpowerID user account can abuse this weakness by changing the email address associated with the user's account to an alternate one under their control. Consequently, the MFA codes that should be sent to the legitimate user are instead delivered to the malicious party's email.

By successfully taking advantage of this vulnerability, an attacker could circumvent MFA safeguards and potentially gain unpermitted access to the victim's account. Such a security breach could enable unauthorized activities, data breaches, or the exposure of confidential information within the impacted EmpowerID system.



Affected Versions:

  *   EmpowerID versions V7.205.0.0 and earlier.



Actions Performed:



EmpowerID has released a patch to version V7.205.0.1 and older versions, which addresses this vulnerability. EmpowerID has contacted customers which are known to use EmpowerID's MFA. It is highly recommended that all customers upgrade to the latest version immediately to mitigate the risk, or contact EmpowerID for patch details.





[signature_889433285]<http://empowerid.com/>
   Nirav Patel

   [signature_1232658466]    nirav.patel@...owerID.com<mailto:nirav.patel@...owerID.com>
   [signature_1909062425]    www.empowerID.com<http://empowerid.com/>

   [signature_729000866] <http://www.youtube.com/user/empowerID>   [signature_2001009733] <https://twitter.com/EmpowerID>   [signature_1070999265] <https://www.facebook.com/220903377569>   [signature_679156352] <https://www.linkedin.com/company/85780>



Download attachment "Outlook-signature_.png" of type "image/png" (2968 bytes)

Download attachment "Outlook-signature_.png" of type "image/png" (243 bytes)

Download attachment "Outlook-signature_.png" of type "image/png" (363 bytes)

Download attachment "Outlook-signature_.png" of type "image/png" (682 bytes)

Download attachment "Outlook-signature_.png" of type "image/png" (3239 bytes)

Download attachment "Outlook-signature_.png" of type "image/png" (732 bytes)

Download attachment "Outlook-signature_.png" of type "image/png" (771 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ