Yubico Security advisory 2020-03-03: Insufficient data validation in yubikey-val

栏目: IT技术 · 发布时间: 4年前

内容简介:Tracking ID:This issue potentially affects developers, partners, and customers who have used a YubiKey Validation Server to build a self-hosted one-time password (OTP) validation service. The default configuration of the service only exposes the verify API

Security advisory 2020-03-03 – insufficient data validation in yubikey-val

Tracking ID: YSA-2020-01, CVE-2020-10184 , CVE-2020-10185

Summary

Yubico received a report from LinkedIn Information Security indicating there is insufficient data validation in the open-source project for YubiKey Validation Server ( git: yubikey-val ). Yubico verified the issue and has made a security update available to mitigate this issue and enhance the validation of information sent to the APIs. The next major release of the YubiKey Validation Server will become available by July 2020. 

This issue potentially affects developers, partners, and customers who have used a YubiKey Validation Server to build a self-hosted one-time password (OTP) validation service. The default configuration of the service only exposes the verify API, which could allow an attacker to perform a denial of service, potentially preventing legitimate authentications. Additionally, if the configuration has been modified to expose the sync API, then this vulnerability could potentially be used by an attacker to replay a previously used OTP.

Affected software

YubiKey Validation Server releases 2.39 and prior: available from https://github.com/Yubico/yubikey-val

Affected Yubico devices and services

None. This advisory only pertains to the YubiKey Validation Server project. It does not affect any  YubiKey Series, Security Key Series, YubiKey firmware, or YubiCloud Service.

Customer actions

If you are managing an implementation of a YubiKey Validation Server, update your deployment to version 2.40 of YubiKey Validation Server (available https://github.com/Yubico/yubikey-val ) to mitigate this issue. Also confirm that the configuration of your service does not unnecessarily expose API endpoints .

How to check your sync API configuration

  1. Go to your configuration script (ykval-config.php)
  2. Look for the following lines:
 $baseParams[‘__YKVAL_ALLOWED_SYNC_POOL__’] = array(
// “1.2.3.4”,
// “2.3.4.5”,
// “3.4.5.6”,
// “fc00:aaaa::”,
// “fc00:bbbb::”,
// “fc00:cccc::”,
);
  1. If there are uncommented IP addresses listed in this array, then these hosts are allowed to use your sync API, and interact with the affected code. These IP addresses should be limited to nodes participating in the sync pool.
  2. If there are no uncommented IP addresses listed in this array, then no hosts are allowed to use the sync API. 

Technical details

There are four API endpoints that can be exposed: verify, sync, resync, and revoke. By default, the verify endpoint is the only API exposed without an IP whitelist. YubiKey Validation Server does not have sufficient input validation implemented in the verify and sync APIs. Insufficient input validation could allow an attacker to perform SQL injection attacks. The level of impact of the SQL injection varies depending on the configuration of the YubiKey Validation Server instance. Verify performs basic validation on all fields prior to executing database queries but does not check length. An attacker could abuse this issue by submitting a large entry to be input into the database, which could cause a denial of service. 

Sync does not perform consistent validation on received parameters prior to executing database queries. However, only sources that are defined in the __YKVAL_ALLOWED_SYNC_POOL__ are allowed to call the sync API, which limits the exposure of this issue. The default configuration does not define any allowed sources for the sync API, meaning all attempts to call the sync API will be denied. YubiKey Validation Server implementers may add IP addresses to the sync pool to enable syncing between multiple validation servers. An attacker with an allowed IP address could potentially use this vulnerability to replay an OTP.

Frequently asked questions

How do I sign up for security or product updates?

To sign up for security or product updates via email, visit our email subscription page: https://pages.yubico.com/email_subscription.html

Is YubiCloud affected?

No, YubiCloud is not affected.


以上所述就是小编给大家介绍的《Yubico Security advisory 2020-03-03: Insufficient data validation in yubikey-val》,希望对大家有所帮助,如果大家有任何疑问请给我留言,小编会及时回复大家的。在此也非常感谢大家对 码农网 的支持!

查看所有标签

猜你喜欢:

本站部分资源来源于网络,本站转载出于传递更多信息之目的,版权归原作者或者来源机构所有,如转载稿涉及版权问题,请联系我们

成功由我

成功由我

刘世英、彭征 / 湖南人民出版社 / 2010-2 / 28.00元

《成功由我:李彦宏快乐成功之道》讲述:他,18岁高分考入北京大学,毕业后到美国名校学习最热门的计算机专业,然后闯荡于华尔街和硅谷这两大金融和技术圣地,31岁回国创立百度……到如今身价数十亿美元,领导的百度发展成为全球第二大搜索引擎,在国内搜索市场占据近八成的市场份额,将有“上帝”之称的Google抛在身后,最近他又掀起了“框计算”风暴,并雄心万丈宣称“未来十年,要让百度在全球一半以上国家成为家喻户......一起来看看 《成功由我》 这本书的介绍吧!

HTML 编码/解码
HTML 编码/解码

HTML 编码/解码

MD5 加密
MD5 加密

MD5 加密工具

正则表达式在线测试
正则表达式在线测试

正则表达式在线测试