Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)

中 5.3CVE-2015-7225 · GHSA-x489-jjwm-52g7 · 06/09/2017 公開 · 17/06/2026 更新

要点

CVE-2015-7225 は devise-two-factor, devise-two-factor (tinfoilsecurity) に影響する深刻度「中」 (CVSS 5.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：2.1%（全脆弱性の 81.4% より高い）。
対処：2.0.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
devise-two-factor RubyGems	`< 2.0.0`	`2.0.0`
devise-two-factor tinfoilsecurity	`≤ 1.1.0`	修正版なし

概要

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow RFC 6238 § 5.2 and does not "burn" a successfully validated one-time password (aka OTP), which allows physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or "shoulder surfing", and replaying the OTP in the current time-step.

NVD の説明

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or shoulder surfing, and replaying the OTP in the current time-step.