امتیازها
113
راهحلها
27
- محل سکونت
- England
- نوشتهها
- 26,276
- تاریخ ثبتنام
- ۱۳۹۹٫۰۴٫۰۶
- پسندها
- 3,286
- سن
- 29
- وب سایت
- xenforo.xyz
- نسخه PHP
- 7.3
- نسخه زنفورو
- xenforo 2.2
Hey there,
I was digging into the WebAuthn implementation and noticed that the
Because there's no
The WebAuthn spec explicitly...
Read more
I was digging into the WebAuthn implementation and noticed that the
xf_passkey table doesn’t store the authenticator’s signature counter.Because there's no
sign_count (or equivalent thereof), the server never checks whether the counter returned by the authenticator is strictly increasing although the library supports it. So XF seems to be currently vulnerable to replay-style assertion attacks and doesn't provide clone detection.The WebAuthn spec explicitly...
Read more