MFA bypass in Firefly III



Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2024-37893
CWE-ID CWE-288
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Firefly III
Client/Desktop applications / Other client software

Vendor James Cole

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Authentication bypass using an alternate path or channel

EUVDB-ID: #VU92253

Risk: Low

CVSSv4.0: 0.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-37893

CWE-ID: CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass MFA checks.

The vulnerability exists due to an error within the Firefly III OAuth flow. A remote attacker can bypass MFA checks and gain unauthorized access to the application.

Note, successful exploitation of the vulnerability requires knowledge of the victim's password.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Firefly III: 3.0.0 - 6.1.17

CPE2.3 External links

https://github.com/firefly-iii/firefly-iii/security/advisories/GHSA-4gm4-c4mh-4p7w
https://owasp.org/www-community/attacks/Password_Spraying_Attack
https://www.menlosecurity.com/what-is/highly-evasive-adaptive-threats-heat/mfa-bypass


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###