Alp1N3-Dev

**Name of the Vulnerable Software and Affected Versions** Vikunja versions 0.8 through 2.1.9 **Description** Vikunja, an open-source self-hosted task management platform, contains a flaw where unauthenticated users can circumvent the application's rate limits. This bypass is achieved by manipulating the `X-Forwarded-For` or `X-Real-IP` headers, as the rate-limiting mechanism relies on the value of `(echo.Context).RealIP`. This allows attackers to make an unlimited number of requests to unauthenticated endpoints. The immediate risk is the potential for brute-forcing usernames or passwords. The vulnerable code resides in the `pkgroutesrate limit.go` file, specifically within the `RateLimit` middleware function, where the `c.RealIP()` function is used to determine the rate-limit key. The `/api/v1/login` API endpoint is susceptible to this issue. **Recommendations** Vikunja versions 0.8 through 2.1.9 are affected and should be upgraded to version 2.2.0 or later to resolve this issue.

**Name of the Vulnerable Software and Affected Versions** Vikunja versions prior to 2.1.0 **Description** The Caldav endpoint allows login using Basic Authentication, which bypasses the TOTP for accounts with 2FA enabled. This allows access to project information normally protected by 2FA, such as project names and descriptions. The issue occurs because the authentication process for Caldav via Basic Authentication skips the 2FA checks. Specifically, the code retrieves basic credentials, verifies the username and password, and then grants access without requiring TOTP verification. An attacker can craft HTTP requests to the Caldav endpoint with Base64-encoded usernames and passwords to bypass 2FA and access authenticated user information. **Recommendations** Versions prior to 2.1.0: Disable Basic Authentication for Caldav by default, but keep token access enabled. Alternatively, implement Basic Auth for Caldav as a feature flag, notifying users in documentation that it is a less secure pattern if 2FA is enabled.

**Name of the Vulnerable Software and Affected Versions** Vikunja (affected versions not specified) **Description** A flaw exists where a Time-based One-Time Password (TOTP) used for successful 2FA authentication can be reused within its 30-second validity window, allowing subsequent authentication attempts with the same code to succeed. This bypasses a security measure intended to ensure each TOTP is used only once. The issue resides in the `ValidateTOTPPasscode` function within `pkg/user/totp.go:128`. The function does not prevent the reuse of valid TOTP codes within the validity window. This disrupts the defense-in-depth model surrounding 2FA, potentially impacting any user employing 2FA. The affected code is located in the `code.vikunja.io/api` module. **Recommendations** Implement a deny-list to store used TOTP codes for their validity windows and check submitted codes against this list to prevent reuse. After the validity window expires, remove the TOTP code from the deny-list.