Security Vulnerability Identified in AWS WorkSpaces MFA Implementation
During the login process for AWS WorkSpaces, users are typically required to authenticate using their username, password, and Multi-Factor Authentication (MFA). For MFA, I utilized the Duo Mobile Application as the second factor.
While testing the login flow, I discovered a significant security vulnerability. Instead of entering the correct MFA code from the authenticator app, I input random six-digit values. Despite the incorrect MFA code, an approval request was still sent to the Duo Mobile application. Upon approving this request within the Duo Mobile app, I was able to successfully log in to my AWS account.
Implications: This behavior suggests that the MFA requirement for AWS WorkSpaces login is effectively bypassed:
- The validity of the MFA code is not enforced as part of the authentication process.
- The approval process relies solely on the user’s interaction with the authenticator app, without verifying the correctness of the input MFA code.
Security Risks:
- MFA Bypass: The intended purpose of MFA—to add a layer of security—is compromised, making the system vulnerable to unauthorized access if an attacker can trick the legitimate user into approving a request.
- False Sense of Security: Users and administrators may believe that MFA is providing robust security when, in practice, it is not.
Recommendation: AWS should promptly investigate and address this issue by ensuring that:
- The system validates the correctness of the MFA code before triggering any approval request to the authenticator app.
- The approval process is tied directly to the successful validation of the MFA code, ensuring both components work in tandem for secure authentication.
- This vulnerability undermines the critical security benefits provided by MFA and needs immediate remediation to prevent potential exploitation.
- Newest
- Most votes
- Most comments
This isn't a security vulnerability but rather, MAYBE, a bug with DUO. The WorkSpaces auth gateways don't validate the MFA token that is passed. That is the job of the RADIUS server/service. In this case, it's DUO. DUO allows the user to enter the 6 digit MFA code OR the user can enter PUSH or SMS into the form field to receive a push notification via DUO Mobile or an SMS notification via standard SMS messaging. This is your second factor authentication.
My suggestion is to check your DUO setup and determine what actions trigger a push or sms notification when an incorrect MFA code is entered.
Relevant content
asked 8 years ago
- AWS OFFICIALUpdated 5 months ago
- AWS OFFICIALUpdated 2 years ago
Thank you for the explanation, Robert. Yes, maybe we can call it a bug, but I thought of it from the perspective of bypassing MFA to mark it as a security vulnerability. I have raised the same concern with Duo as well, as we do not have internal insights into how they are communicating internally. In some applications, the application itself verifies the MFA rather than relying on verification from the authenticator app.
The DUO RADIUS server should have sent
REJECTresponse to the auth gateway here instead ofACCEPTresponse if the code was incorrect. Since the auth gateway receivedACCEPTresponse from DUO, the authentication was successful. This should be fixed by DUO. You can verify this behavior by looking at logs or taking a network trace from the RADIUS server and see what is being return by DUO in response to the request sent by WorkSpaces for 2nd FA if the code is incorrect.