Releases for Two-factor Authentication (TFA)

General fixes and tasks

Ensure routing system matches TFA expectations.

This is still somewhat work-in-progress. Do not use in production!

Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043.

Changes since 7.x-2.3:

Bugfix and features

Resolves SA-CONTRIB-2024-003.

Security Fix: Access Bypass Through Replay Attacks

Impacted versions

• Two-factor Authentication (TFA) 8.x-1.x versions prior to 8.x-1.3
• Two-factor Authentication (TFA) 2.x versions prior to and including 2.0.0-alpha2

Security risk

AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default

CVSS 3.1 Base Score: 4.5: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Vulnerability Type

Access Bypass

Resolves SA-CONTRIB-2023-030

Insecure

This release (and previous 2.0.0 releases) are vulnerable to:
SA-CONTRIB-2023-030. See https://www.drupal.org/project/tfa/issues/3374221 for more details.
Access Bypass Through Replay Attacks
Authentication bypass when default plugin is not configured
SA-CONTRIB-2024-003

This release starts with the Drupal 10 support for the module, and uses a new plugin architecture in which the TFA plugins are no longer separated in functional and setup plugins.

Contributors (3)

jcnventura, heddn, guilhermevp

Changelog

Issues: 3 issues resolved.

Note that while related with the TFA link vulnerability in version 8.x-1.0-alpha8 of this module, the bug here is a lot milder, as only the user that inserted the username and password can access the TFA entry form. Even though that form doesn't expire, the flood control mechanism strongly limits the number of possible attempted guesses before the window for that guess expires and invalidates the attack.

Changes since 7.x-2.1:

ALL SITES ARE RECOMMENDED TO UPDATE to either 8.x-1.0-alpha9 or 8.x-1.0-alpha10. alpha9 is the same code as alpha8, with the vulnerability fix.

Issue #3314706 allows an attacker to bypass the user and password check, as long as they have access to an unused TFA verification URL, and to the user's authenticator app. Brute-force attacks while possible, are not feasible as the flood mechanism limits the rate of attempted guesses.

Changes since 8.x-1.0-alpha8:

Changes since 8.x-1.0-alpha7:

This release hardens the code against timing attacks on the code validation. We recommend that all users upgrade to this version.

Changes since 8.x-1.0-alpha5:

This is a pre-release of 7.x-2.1, mainly with the changes necessary to allow the use of the module without having to install the Mcrypt extension, which was removed in PHP 7.2.

Changes since 7.x-2.0:

Summary: 8.x-1.0-alpha4

Continuing to move the api towards a well-documented stable release. Due to changes, complimentary modules such as ga_login or tfa_duo will need to be updated as well. See Roadmap to stable D8 TFA release for more details.

New feature allows users to configure multiple 2nd-factor options on their account.

Contributors: (10) daggerhart, benjifisher, rbayliss, gbirch, ChrisDarke, Manuel Garcia, nerdstein, derek.deraps, sanduhrs, bhawanac

Fixing a user-id enumeration and brute force vulnerability. Addressing many bug fixes.

Initial TFA 8.x dev release

Beta 3 release of TFA module for Drupal 7 fixes minor security risk. Read about risk and mitigating factors at https://www.drupal.org/node/2628736.

This release makes no schema or plugin compatibility changes, upgrade is recommended for all sites running TFA

Changes since 7.x-2.0-beta2:

Beta release of TFA 2.x for Drupal 7. TFA 2 is a complete rewrite of the TFA module, providing two-factor authentication (2FA) for Drupal sites.

Please note, this is a beta release and there are expected to be enhancements and possibly breaking changes before a full and stable 2.0 release. Subscribe to updates on stable release at https://www.drupal.org/node/2241821. Sites installing TFA module and using custom TFA plugins are advised to follow updates closely.

1.0 release of Two-factor Authentication module for Drupal 7 with included support for SMS Framework for sending one-time login codes as a method of increasing the authentication security of your Drupal site.

Drupal 7 compatible development release of the Two-factor Authentication module. You are advised to not run development releases on production-level systems.