If you have a multi-step form, and add a captcha in the second step or later, when you submit the step with the captcha displayed, you see the error message "CAPTCHA session reuse attack detected.".

CommentFileSizeAuthor
#4 multistep_captcha_session_resuse_attack-2453723-04.patch1002 bytesnicrodgers
#1 multistep_captcha_session_resuse_attack-2453723-01.patch1.14 KBnicrodgers

Comments

nicrodgers’s picture

nicrodgers
Primary language English
Location Monmouthshire, UK
commented
StatusFileSize
new multistep_captcha_session_resuse_attack-2453723-01.patch1.14 KB

On debugging, it looks as if the check in _captcha_get_posted_captcha_info is setting $posted_captcha_token based on whether or not $form_state['input']['captcha_token'] is set.

The trouble is, the default value here is an empty string, so it takes that, and then fails the comparison if ($expected_captcha_token !== $posted_captcha_token) as it's effectively doing if ( NULL != '' ).

Changing isset() to empty() seems to fix the issue. Patch attached.

nicrodgers’s picture

nicrodgers
Primary language English
Location Monmouthshire, UK
commented
Status: Active » Needs review

Status: Needs review » Needs work

The last submitted patch, 1: multistep_captcha_session_resuse_attack-2453723-01.patch, failed testing.

nicrodgers’s picture

nicrodgers
Primary language English
Location Monmouthshire, UK
commented
StatusFileSize
new multistep_captcha_session_resuse_attack-2453723-04.patch1002 bytes

Uploading a corrected patch.

nicrodgers’s picture

nicrodgers
Primary language English
Location Monmouthshire, UK
commented
Status: Needs work » Needs review
podarok’s picture

podarok
🇺🇦 he/him/his
Primary language Ukrainian
Location Ukraine
commented
Status: Needs review » Fixed

  • podarok committed c0f872c on 7.x-1.x authored by nicrodgers 
    Issue #2453723 by nicrodgers: Session reuse attack error incorrectly...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.