abraxas/openmeetings-soap-otp-skipApache OpenMeetings 9.1.0 - High - Remote - 2FA skip - SOAP/REST password login skips TOTP
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · openmeetings-soap-otp-skip
Class: 2FA skip Reach: Remote
Apache OpenMeetings 9.1.0. When otp.enabled is true, TOTP runs only in Wicket SignInDialog.processOtp. UserWebService.login is password then sessionDao.create. SOAP/REST mint a SID with no OTP field. Default otp.enabled is false. The lab turns it on.
| ID | no CVE yet |
| Class | 2FA skip |
| Reach | Remote (password, no OTP) |
| CWE | CWE-287, CWE-304 |
| CVSS | High: 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| Product | Apache OpenMeetings 9.1.0 with otp.enabled=true |
| Auth | password of an enrolled user |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1:18157 only |
| Method | Sink | Privilege |
|---|---|---|
POST /services/user/login user/pass only | UserWebService.login (UserWebService.java:135-143) | Integrity (lab-proven): SID without OTP. Lab: calendar save with that SID stored the witness. |
| Wicket password-only (control) | SignInDialog.processOtp | Closed on Wicket: OTP challenge shown, no dashboard. |
Closed: default otp.enabled=false (this leftover is the enabled deployment). LDAP search-filter injection (OPENMEETINGS-2808).
cd lab
./run.sh
Last line: SUCCESS OPENMEETINGS-SOAP-OTP-SKIP-WITNESS
Suggested fix: call OtpManager.verify in UserWebService.login and JAX-WS login when the user has a TOTP secret. Fail closed if OTP is enabled and the request has no code.
Abraxas Labs - https://abraxaslabs.tech - https://github.com/abraxas - https://x.com/abraxas_null - [email protected]
Vendor: [email protected]