CyberRota Analysis
AI-GeneratedSnipe-IT versions prior to 8.6.1 are vulnerable to a lack of rate limiting on the two-factor authentication endpoint, allowing attackers with valid credentials to perform unlimited TOTP guesses, potentially gaining unauthorized access. Additionally, an authenticated user can disable two-factor authentication without re-verification, posing a significant security risk. Organizations using Snipe-IT should prioritize upgrading to version 8.6.1 to mitigate these vulnerabilities.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successful guess creates a fully authenticated session. When two_factor_enabled is 1, POST /account/profile with two_factor_optin=0 can disable two-factor authentication without OTP reverification, while required mode 2 prevents that opt-out. An administrator can also use POST /api/v1/users/two_factor_reset to clear another user's secret. This issue is fixed in version 8.6.1.