CVE-2021-38299 Improper Access Control in Webauthn Framework
An attacker with physical access can bypass user presence checks to log in using a FIDO2 authenticator in the Webauthn Framework library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-38299?
CVE-2021-38299 is a critical authentication bypass vulnerability in n/a, published on 27 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence.
Weakness: CWE-287
Which versions are affected by CVE-2021-38299?
2 open source packages ship an affected version, including web-auth/webauthn-framework. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
web-auth/webauthn-framework Packagist | From 3.3.0 | 3.3.4 |
web-auth/webauthn-framework Packagist | From 3.3.0 | 3.3.4 |
Products include Spomky-Labs Webauthn Framwork.
How do I fix CVE-2021-38299?
Upgrade web-auth/webauthn-framework to 3.3.4 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-38299 being exploited?
There is no known exploitation of CVE-2021-38299 in the wild and no public exploit code.
Sources
Also known as GHSA-6whf-q6p5-84wg.