Passkey implementation lacks signature counter to prevent clone attacks

[SeToY]

Hey there,

I was digging into the WebAuthn implementation and noticed that the xf_passkey table doesn’t store the authenticator’s signature counter.

Because there's no sign_count (or equivalent thereof), the server never checks whether the counter returned by the authenticator is strictly increasing although the library supports it. So XF seems to be currently vulnerable to replay-style assertion attacks and doesn't provide clone detection.

The WebAuthn spec explicitly...

Read more

Continue reading...