GHSA-9phw-7h96-q3rv: 
PHP vulnerability analysis and mitigation

A security vulnerability was discovered in the scheb/two-factor-bundle project affecting versions prior to 3.26.0 and 4.11.0. The vulnerability allowed attackers to bypass two-factor authentication (2FA) by manipulating the remember-me cookie functionality. The issue was reported on December 5, 2019, and was fixed with the release of versions 3.26.0 and 4.11.0 on December 8, 2019 (GitHub Advisory).

The vulnerability occurred when users utilized the remember_me checkbox during login, which created a 'REMEMBERME' cookie. After being redirected to the 2FA page, attackers could manipulate the SESSIONID key using browser cookie inspection tools. By removing the SESSIONID key, users could access the homepage '/' with IS_AUTHENTICATED_REMEMBERED status, effectively bypassing the two-factor authentication requirement (GitHub Issue). The vulnerability has been assigned a CVSS v3.1 score of 7.4 (High), with attack vector: Network, attack complexity: High, privileges required: None, user interaction: None, scope: Unchanged, and impact on confidentiality and integrity: High (GitHub Advisory).

The vulnerability allowed unauthorized users to bypass the two-factor authentication security measure, potentially gaining access to protected resources and user accounts. This bypass effectively nullified the additional security layer provided by 2FA, exposing systems to unauthorized access with only the first authentication factor (GitHub Advisory).

The vulnerability could be exploited by manipulating browser cookies. An attacker needed to have valid login credentials and access to the remember-me functionality. The exploitation process involved checking the remember-me checkbox during login, waiting for the REMEMBERME cookie to be created, and then removing the SESSIONID key using browser developer tools (GitHub Issue).

The vulnerability was fixed in versions 3.26.0 and 4.11.0 of the scheb/two-factor-bundle. The fix involved preventing the remember-me cookie from being set when two-factor authentication is required. Users are advised to upgrade to version 3.26.0 or higher for the 3.x branch, or version 4.11.0 or higher for the 4.x branch (GitHub Issue).