Skip to content

Commit

Permalink
Fix security vulnerability when authenticating a two-factor authentic…
Browse files Browse the repository at this point in the history 
…ation token for a user

See associated security advisory for technical details on the content of this security fix.

GHSA ID: GHSA-5vfx-8w6m-h3v4
  • Loading branch information
@DaneEveritt
DaneEveritt committed Sep 22, 2021
1 parent 5fdb0a5 commit 4a84c36
Show file tree
Hide file tree
Showing 3 changed files with 85 additions and 109 deletions.
31 changes: 12 additions & 19 deletions app/Http/Controllers/Auth/AbstractLoginController.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
use Illuminate\Auth\AuthManager;
use Illuminate\Http\JsonResponse;
use Illuminate\Auth\Events\Failed;
use Illuminate\Contracts\Config\Repository;
use Illuminate\Container\Container;
use Pterodactyl\Exceptions\DisplayException;
use Pterodactyl\Http\Controllers\Controller;
use Illuminate\Contracts\Auth\Authenticatable;
Expand All @@ -17,6 +17,8 @@ abstract class AbstractLoginController extends Controller
{
use AuthenticatesUsers;

protected AuthManager $auth;

/**
* Lockout time for failed login requests.
*
Expand All @@ -38,26 +40,14 @@ abstract class AbstractLoginController extends Controller
*/
protected $redirectTo = '/';

/**
* @var \Illuminate\Auth\AuthManager
*/
protected $auth;

/**
* @var \Illuminate\Contracts\Config\Repository
*/
protected $config;

/**
* LoginController constructor.
*/
public function __construct(AuthManager $auth, Repository $config)
public function __construct()
{
$this->lockoutTime = $config->get('auth.lockout.time');
$this->maxLoginAttempts = $config->get('auth.lockout.attempts');

$this->auth = $auth;
$this->config = $config;
$this->lockoutTime = config('auth.lockout.time');
$this->maxLoginAttempts = config('auth.lockout.attempts');
$this->auth = Container::getInstance()->make(AuthManager::class);
}

/**
Expand All @@ -84,12 +74,14 @@ protected function sendFailedLoginResponse(Request $request, Authenticatable $us
*/
protected function sendLoginResponse(User $user, Request $request): JsonResponse
{
$request->session()->remove('auth_confirmation_token');
$request->session()->regenerate();

$this->clearLoginAttempts($request);

$this->auth->guard()->login($user, true);

return JsonResponse::create([
return new JsonResponse([
'data' => [
'complete' => true,
'intended' => $this->redirectPath(),
Expand All @@ -101,7 +93,8 @@ protected function sendLoginResponse(User $user, Request $request): JsonResponse
/**
* Determine if the user is logging in using an email or username,.
*
* @param string $input
* @param string|null $input
* @return string
*/
protected function getField(string $input = null): string
{
Expand Down
107 changes: 54 additions & 53 deletions app/Http/Controllers/Auth/LoginCheckpointController.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,64 +2,36 @@

namespace Pterodactyl\Http\Controllers\Auth;

use Carbon\CarbonInterface;
use Carbon\CarbonImmutable;
use Pterodactyl\Models\User;
use Illuminate\Auth\AuthManager;
use Illuminate\Http\JsonResponse;
use PragmaRX\Google2FA\Google2FA;
use Illuminate\Contracts\Config\Repository;
use Illuminate\Contracts\Encryption\Encrypter;
use Illuminate\Database\Eloquent\ModelNotFoundException;
use Pterodactyl\Http\Requests\Auth\LoginCheckpointRequest;
use Illuminate\Contracts\Cache\Repository as CacheRepository;
use Pterodactyl\Contracts\Repository\UserRepositoryInterface;
use Pterodactyl\Repositories\Eloquent\RecoveryTokenRepository;
use Illuminate\Contracts\Validation\Factory as ValidationFactory;

class LoginCheckpointController extends AbstractLoginController
{
/**
* @var \Illuminate\Contracts\Cache\Repository
*/
private $cache;

/**
* @var \Pterodactyl\Contracts\Repository\UserRepositoryInterface
*/
private $repository;
private const TOKEN_EXPIRED_MESSAGE = 'The authentication token provided has expired, please refresh the page and try again.';

/**
* @var \PragmaRX\Google2FA\Google2FA
*/
private $google2FA;
private ValidationFactory $validation;

/**
* @var \Illuminate\Contracts\Encryption\Encrypter
*/
private $encrypter;
private Google2FA $google2FA;

/**
* @var \Pterodactyl\Repositories\Eloquent\RecoveryTokenRepository
*/
private $recoveryTokenRepository;
private Encrypter $encrypter;

/**
* LoginCheckpointController constructor.
*/
public function __construct(
AuthManager $auth,
Encrypter $encrypter,
Google2FA $google2FA,
Repository $config,
CacheRepository $cache,
RecoveryTokenRepository $recoveryTokenRepository,
UserRepositoryInterface $repository
) {
parent::__construct($auth, $config);
public function __construct(Encrypter $encrypter, Google2FA $google2FA, ValidationFactory $validation)
{
parent::__construct();

$this->google2FA = $google2FA;
$this->cache = $cache;
$this->repository = $repository;
$this->encrypter = $encrypter;
$this->recoveryTokenRepository = $recoveryTokenRepository;
$this->validation = $validation;
}

/**
Expand All @@ -81,18 +53,20 @@ public function __invoke(LoginCheckpointRequest $request): JsonResponse
$this->sendLockoutResponse($request);
}

$token = $request->input('confirmation_token');
$details = $request->session()->get('auth_confirmation_token');
if (!$this->hasValidSessionData($details)) {
$this->sendFailedLoginResponse($request, null, self::TOKEN_EXPIRED_MESSAGE);
}

if (!hash_equals($request->input('confirmation_token') ?? '', $details['token_value'])) {
$this->sendFailedLoginResponse($request);
}

try {
/** @var \Pterodactyl\Models\User $user */
$user = User::query()->findOrFail($this->cache->get($token, 0));
$user = User::query()->findOrFail($details['user_id']);
} catch (ModelNotFoundException $exception) {
$this->incrementLoginAttempts($request);

return $this->sendFailedLoginResponse(
$request,
null,
'The authentication token provided has expired, please refresh the page and try again.'
);
$this->sendFailedLoginResponse($request, null, self::TOKEN_EXPIRED_MESSAGE);
}

// Recovery tokens go through a slightly different pathway for usage.
Expand All @@ -104,15 +78,11 @@ public function __invoke(LoginCheckpointRequest $request): JsonResponse
$decrypted = $this->encrypter->decrypt($user->totp_secret);

if ($this->google2FA->verifyKey($decrypted, (string) $request->input('authentication_code') ?? '', config('pterodactyl.auth.2fa.window'))) {
$this->cache->delete($token);

return $this->sendLoginResponse($user, $request);
}
}

$this->incrementLoginAttempts($request);

return $this->sendFailedLoginResponse($request, $user, !empty($recoveryToken) ? 'The recovery token provided is not valid.' : null);
$this->sendFailedLoginResponse($request, $user, !empty($recoveryToken) ? 'The recovery token provided is not valid.' : null);
}

/**
Expand All @@ -135,4 +105,35 @@ protected function isValidRecoveryToken(User $user, string $value)

return false;
}

/**
* Determines if the data provided from the session is valid or not. This
* will return false if the data is invalid, or if more time has passed than
* was configured when the session was written.
*
* @param array $data
* @return bool
*/
protected function hasValidSessionData(array $data): bool
{
$validator = $this->validation->make($data, [
'user_id' => 'required|integer|min:1',
'token_value' => 'required|string',
'expires_at' => 'required',
]);

if ($validator->fails()) {
return false;
}

if (!$data['expires_at'] instanceof CarbonInterface) {
return false;
}

if ($data['expires_at']->isBefore(CarbonImmutable::now())) {
return false;
}

return true;
}
}
56 changes: 19 additions & 37 deletions app/Http/Controllers/Auth/LoginController.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,47 +5,24 @@
use Carbon\CarbonImmutable;
use Illuminate\Support\Str;
use Illuminate\Http\Request;
use Illuminate\Auth\AuthManager;
use Pterodactyl\Models\User;
use Illuminate\Http\JsonResponse;
use Illuminate\Contracts\View\View;
use Illuminate\Contracts\Config\Repository;
use Illuminate\Contracts\View\Factory as ViewFactory;
use Illuminate\Contracts\Cache\Repository as CacheRepository;
use Pterodactyl\Contracts\Repository\UserRepositoryInterface;
use Pterodactyl\Exceptions\Repository\RecordNotFoundException;
use Illuminate\Database\Eloquent\ModelNotFoundException;

class LoginController extends AbstractLoginController
{
/**
* @var \Illuminate\Contracts\View\Factory
*/
private $view;

/**
* @var \Illuminate\Contracts\Cache\Repository
*/
private $cache;

/**
* @var \Pterodactyl\Contracts\Repository\UserRepositoryInterface
*/
private $repository;
private ViewFactory $view;

/**
* LoginController constructor.
*/
public function __construct(
AuthManager $auth,
Repository $config,
CacheRepository $cache,
UserRepositoryInterface $repository,
ViewFactory $view
) {
parent::__construct($auth, $config);
public function __construct(ViewFactory $view)
{
parent::__construct();

$this->view = $view;
$this->cache = $cache;
$this->repository = $repository;
}

/**
Expand All @@ -68,31 +45,36 @@ public function index(): View
*/
public function login(Request $request): JsonResponse
{
$username = $request->input('user');
$useColumn = $this->getField($username);

if ($this->hasTooManyLoginAttempts($request)) {
$this->fireLockoutEvent($request);
$this->sendLockoutResponse($request);
}

try {
$user = $this->repository->findFirstWhere([[$useColumn, '=', $username]]);
} catch (RecordNotFoundException $exception) {
return $this->sendFailedLoginResponse($request);
$username = $request->input('user');

/** @var \Pterodactyl\Models\User $user */
$user = User::query()->where($this->getField($username), $username)->firstOrFail();
} catch (ModelNotFoundException $exception) {
$this->sendFailedLoginResponse($request);
}

// Ensure that the account is using a valid username and password before trying to
// continue. Previously this was handled in the 2FA checkpoint, however that has
// a flaw in which you can discover if an account exists simply by seeing if you
// can proceede to the next step in the login process.
if (!password_verify($request->input('password'), $user->password)) {
return $this->sendFailedLoginResponse($request, $user);
$this->sendFailedLoginResponse($request, $user);
}

if ($user->use_totp) {
$token = Str::random(64);
$this->cache->put($token, $user->id, CarbonImmutable::now()->addMinutes(5));

$request->session()->put('auth_confirmation_token', [
'user_id' => $user->id,
'token_value' => $token,
'expires_at' => CarbonImmutable::now()->addMinutes(5),
]);

return new JsonResponse([
'data' => [
Expand Down

0 comments on commit 4a84c36

Please sign in to comment.