Always verify the old password when changing it #38203
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bl-nero
commented
Feb 14, 2024
zmb3
approved these changes
Feb 14, 2024
jentfoo
approved these changes
Feb 14, 2024
codingllama
approved these changes
Feb 14, 2024
public-teleport-github-review-bot
bot
removed request for
greedy52 and
kimlisa
|
Added backport tags to active versions. |
marcoandredinis
pushed a commit
that referenced
this pull request
Feb 19, 2024
* Always verify the old password when changing it * review
This was referenced Mar 5, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes https://github.com/gravitational/teleport-private/issues/1369
Approved for fixing directly on OSS by @jentfoo.
Note that the logic here will be further amended by the upcoming implementation of RFD 0159; this change is a trimmed down subset of it that will need to be privately backported to all of the supported branches.
Tested locally; the following cases were covered:
Changing password with MFA, through the exploit mentioned in the attached issue.
Changing password without MFA (success, wrong password).
Changing password with an authenticator app (success, wrong old password, wrong app token).
Changing password with an MFA device (success, wrong password).
Changing password with an passwordless device (success, wrong password).
The behavior was verified both by looking at success/error messages, as well as an attempt to sign in using the new password.
Changelog: Fixed an issue where it was possible to skip providing old password when setting a new one.