Public followup for SA-CONTRIB-2024-043

Problem/Motivation

Clarifying information:
This vulnerability is a high complexity attack, requiring active user interaction and the ability for an attacker to inject a valid session ID known to the attacker onto a victims prior to the the victim attempting to log in with traditional user+password followed by the ability to interface with, exfiltrate from or otherwise be able to calculate the two-factor authentication request page response. The attacker would still be compelled to present a valid second factor credential to complete the login and must do so prior to the expiration of a 5 minute validity timer.

Methods for either setting the session or obtaining the response are not defined within the vulnerability report as they are out of scope of the flaw.

While the Drupal Security Team calculator scores this as Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All
a CVSS:4.0 score would be closer to Low: 2.1 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/AU:N/R:U/V:D/RE:L/U:Clear

Problem/Motivation

Public followup in 2 weeks for SA-CONTRIB-2024-043 to publish tests and associate materials.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes