web-auth webauthn-framework up to 4.8.x ProfileBasedRequestOptionsBuilder response discrepancy

Summaryinfo

A vulnerability was found in web-auth webauthn-framework up to 4.8.x. It has been rated as problematic. This affects the function ProfileBasedRequestOptionsBuilder. This manipulation causes response discrepancy. This vulnerability is tracked as CVE-2024-39912. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in web-auth webauthn-framework up to 4.8.x. It has been declared as problematic. Affected by this vulnerability is the function ProfileBasedRequestOptionsBuilder. The manipulation with an unknown input leads to a response discrepancy vulnerability. The CWE definition for the vulnerability is CWE-204. The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. As an impact it is known to affect confidentiality. The summary by CVE is:

web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any credentials if no username was found. When WebAuthn is used as the first or only authentication method, an attacker can enumerate usernames based on the absence of the `allowedCredentials` property in the assertion options response. This allows enumeration of valid or invalid usernames. By knowing which usernames are valid, attackers can focus their efforts on a smaller set of potential targets, increasing the efficiency and likelihood of successful attacks. This issue has been addressed in version 4.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

The advisory is shared at github.com. This vulnerability is known as CVE-2024-39912 since 07/02/2024. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 4.9.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• web-auth

Name

• webauthn-framework

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8

Website

• Product: https://github.com/web-auth/webauthn-framework/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion