Impact

Attackers can bypass multi-factor authentication by programmatically guessing TOTP codes. This exposes accounts to unauthorized access if a primary password has already been compromised.

Recommendation

• Upgrade SOGo to version 5.12.13 or later immediately to apply the rate limiting fix.
• Review authentication logs for patterns of high-frequency failed TOTP attempts originating from single user accounts or IP addresses.
• Audit existing user passwords for compromise, as the threat relies on prior acquisition of the password.

Attack Chain

1. Attacker identifies a target account with a configured secret question.
2. Attacker interacts with the passwordRecoveryCheck API endpoint.
3. Attacker submits repeated, automated requests containing guessed answers to the secret question.
4. Attacker successfully guesses the correct answer due to a lack of rate limiting.
5. Application issues a recovery JWT to the attacker.
6. Attacker uses the recovery JWT to reset the victim's account password via the password reset functionality.
7. Attacker logs into the target account via the connect endpoint, achieving full account takeover.

Impact

Successful exploitation results in full account takeover for any account that has not enabled TOTP. This allows unauthorized access to sensitive user data and account functions.

Recommendation

Upgrade SOGo to version 5.12.13 or later immediately. For environments where patching cannot occur immediately, monitor web server logs for anomalous volumes of POST requests targeting the passwordRecoveryCheck endpoint from single source IPs.