Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability in SOGo's web login allows attackers to bypass two-factor authentication if they already have a user's password. This issue could potentially allow unauthorized access to accounts.
- Bypasses two-factor login if password is known.
- Affects systems enabling remote access.
- Confirm if SOGo is used and if accounts have lost passwords.
Attack Path
How an attacker could exploit the issue
An attacker who already knows a victim's password can repeatedly guess the two-factor authentication code without being blocked. This is possible because the system doesn't track failed second-factor attempts, allowing attackers to try many codes quickly until they find the correct one and gain access to the account.
- Attacker possesses victim's password.
- Repeatedly submit TOTP codes.
- Bypass two-factor authentication.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, an attacker who already possesses a victim's password could repeatedly guess the second-factor authentication code, bypassing two-factor authentication by exploiting a missing rate limit on TOTP verification.
- User credentials could be compromised.
- Attackers could brute-force verification codes.
- Unauthorized account access may occur.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability likely impacts organizations using SOGo for their email and groupware services, making the platform or application support teams responsible for assessing and mitigating the risk. The first practical step is to inventory all SOGo instances, determine their internet exposure and business criticality, and identify the accountable owner for each deployment before planning remediation.
- Identify SOGo deployment owners.
- Verify internet exposure and criticality.
- Plan remediation based on exposure.
