Anonymous Tip Line Vulnerability: Lack of 2FA for Changing Security Settings

CVE-2024-38523

What is CVE-2024-38523?

The TOTP authentication mechanism in Hush Line, an anonymous-tip-line service developed by SCIDSG, presents several vulnerabilities that compromise its intended security functions. Specifically, the authentication flow does not adequately enforce two-factor authentication (2FA) for altering crucial security settings. This oversight enables potential attackers to exploit Cross-Site Request Forgery (CSRF) or Cross-Site Scripting (XSS) attacks to modify those settings without needing user interaction. The severity of this vulnerability underscores the importance of implementing 2FA in securing authentication processes. The issue has been resolved in version 0.10 of Hush Line.

References