Observable discrepancy in TeamPass - #VU140735

Vulnerability details

The vulnerability allows a remote attacker to enumerate valid usernames and verify guessed passwords for arbitrary accounts.

The vulnerability exists due to observable discrepancy and improper restriction of excessive authentication attempts in the ga_generate_qr handler in app/sources/main.queries.php when processing crafted unauthenticated requests for login enrollment. A remote attacker can send repeated specially crafted requests to enumerate valid usernames and verify guessed passwords for arbitrary accounts.

The responses differ for unknown usernames and wrong passwords, and this code path performs no brute-force accounting or lockout.

Affected software

Remediation

External References

• https://github.com/nilsteampassnet/TeamPass/security/advisories/GHSA-6x6x-v79m-v5x3