Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Missing documentation of an option needed to avoid a vulnerability allowing Passwordless to be bypassed if a developer doesn't double-check it on the server-side #350

Open
bockp opened this issue Nov 21, 2021 · 0 comments · May be fixed by #372
Open

Missing documentation of an option needed to avoid a vulnerability allowing Passwordless to be bypassed if a developer doesn't double-check it on the server-side #350

bockp opened this issue Nov 21, 2021 · 0 comments · May be fixed by #372

Comments

@bockp
Copy link

bockp commented Nov 21, 2021

As laid out in this article from August 2020:

https://hwsecurity.dev/2020/08/webauthn-pin-bypass/

Android 7+ (possibly other phone OS too ?) currently don't have a properly configured NFC system for Yubikeys when it comes to Passwordless login.

Their authentication system (as well as the above articles Browser-based exploit code) allows the browser-side authenticator to ignore the requirement of User Verification and send in a challenge that is recognized as valid, thus allowing a user to log in using just Username + NFC yubikey, without checking the UV at all.

You've already got one test in your test suite that has the proper code, so it is supported already:

webauthn-ruby/spec/webauthn/authenticator_assertion_response_spec.rb

Line 133 in 9544853

user_verification: true

Just need a mention in this piece of documentation that if using a key as Passwordless the "user_verification: true" needs to be in the .verify() code or it won't properly check it's a valid Passwordless (User Presence + User Verification) login, and an exploit can bypass it.

https://github.com/cedarcode/webauthn-ruby#publickeycredentialwithassertionverifychallenge-public_key-sign_count
@bockp bockp changed the title Missing documentation of an option needed to aboid a vulnerability allowing Passwordless to be bypassed if a developer doesn't double-check it on the server-side Missing documentation of an option needed to avoid a vulnerability allowing Passwordless to be bypassed if a developer doesn't double-check it on the server-side Nov 22, 2021
tcannonfodder added a commit to tcannonfodder/webauthn-ruby that referenced this issue Sep 20, 2022
@tcannonfodder
Update documentation to avoid PIN bypass
98cb710 
This fixes cedarcode#350, which pointed out a bug in certain browser/device combinations that allow bypassing the user's PIN if the `user_verfication: true` flag is not set.

https://hwsecurity.dev/2020/08/webauthn-pin-bypass/
@tcannonfodder tcannonfodder linked a pull request Sep 20, 2022 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Update documentation to avoid PIN bypass tcannonfodder/webauthn-ruby
1 participant
@bockp