CVE-2025-23017

Executive Summary

CVE-2025-23017 is a security vulnerability in WorkOS Hosted AuthKit that allows an attacker with knowledge of a user’s password to bypass multi-factor authentication (MFA) by enrolling a new authentication factor. The vulnerability was present in versions prior to January 7, 2025. No active exploitation has been reported, and the EPSS score is 0.0%, indicating low immediate threat. However, the flaw undermines MFA protections, potentially allowing account takeover if credentials are compromised.

Supply Chain & Package Security

WorkOS Hosted AuthKit is a cloud-based authentication service. The vulnerability does not directly affect open-source packages (NPM, PyPI, Go, Ruby) but impacts the hosted service itself. Organizations using WorkOS AuthKit should ensure their tenant is updated to the latest version.

CVSS Breakdown & Threat Level

• CVSS Score: 6.0 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (attacker needs user’s password)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (potential access to user data)
• Integrity Impact: High (attacker can enroll new MFA factor)
• Availability Impact: None

Threat Level: Medium. The vulnerability requires prior credential compromise, but once obtained, MFA can be bypassed, leading to account takeover.

Deep Dive & Mechanics

The vulnerability lies in the MFA enrollment process of WorkOS Hosted AuthKit. When a user authenticates with a password, the system should require existing MFA verification before allowing enrollment of a new factor. However, due to improper state validation, an attacker who knows the user’s password can directly enroll a new authentication factor (e.g., TOTP, SMS) without providing the current MFA code. This effectively bypasses MFA protections.

Root Cause: The authentication flow does not enforce MFA challenge before factor enrollment when the session is initiated via password-only authentication. The server fails to check whether the user has an existing MFA factor that must be verified before adding a new one.

Attack Scenario:

1. Attacker obtains user’s password (via phishing, credential stuffing, or data breach).
2. Attacker logs in to WorkOS AuthKit with the password.
3. Attacker navigates to MFA settings and enrolls a new factor (e.g., attacker’s TOTP app).
4. The system accepts the new factor without requiring the existing MFA code.
5. Attacker now has full access to the account, and the legitimate user may be locked out.

Vulnerable vs. Patched Code

No specific code snippets are available from public sources. However, the fix likely involves adding a server-side check that verifies the user’s current MFA factor before allowing enrollment of a new one. The patched version (post-2025-01-07) should enforce this check.

Vulnerable Logic (pseudocode):

// Vulnerable: No MFA check before enrollment
function enrollFactor(user, newFactor) {
    if (user.isAuthenticated) {
        // Directly enroll without verifying existing MFA
        user.factors.push(newFactor);
        return success;
    }
}

Patched Logic (pseudocode):

// Patched: Require MFA verification before enrollment
function enrollFactor(user, newFactor) {
    if (user.isAuthenticated && user.hasMFA) {
        if (!user.verifiedMFAThisSession) {
            return error("MFA verification required");
        }
    }
    user.factors.push(newFactor);
    return success;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid username and password for a WorkOS AuthKit account.
• Access to the WorkOS AuthKit login page.

Steps:

1. Log in with the compromised credentials.
2. Navigate to the security settings or MFA management page.
3. Add a new authentication factor (e.g., TOTP using an authenticator app).
4. Confirm the new factor is added without being prompted for the existing MFA code.
5. Use the new factor to authenticate and gain full access.

Proof of Concept (No public exploit code available):

# Example using curl (hypothetical)
curl -X POST https://authkit.workos.com/api/enroll-factor \
  -H "Authorization: Bearer <session_token>" \
  -d '{"factor_type": "totp", "label": "attacker_device"}'

Blue Team (Detection & Prevention)

Detection:

• Monitor for MFA enrollment events that occur shortly after password-only authentication.
• Alert on multiple MFA factor enrollments from the same user in a short time.
• Look for login sessions where MFA was not verified but factor enrollment occurred.

Prevention:

• Enforce MFA verification before any factor enrollment.
• Implement step-up authentication for sensitive actions.
• Use risk-based authentication to flag suspicious enrollment attempts.

Indicators of Compromise (IOCs)

• Log Events:
  • event_type: "mfa_factor_enrolled" without preceding mfa_verified event.
  • event_type: "login_success" followed by mfa_factor_enrolled within 5 minutes.
• Network Indicators:
  • API calls to /api/enroll-factor or similar endpoints.
• User Behavior:
  • Enrollment of new MFA factors from unusual IP addresses or geolocations.
  • Multiple failed MFA attempts followed by successful enrollment.

Detection Engineering

YARA Rule

rule CVE_2025_23017_MFA_Bypass {
    meta:
        description = "Detects MFA bypass attempts via unauthorized factor enrollment"
        author = "Valters IT"
        date = "2025-01-15"
        reference = "CVE-2025-23017"
    strings:
        $enroll = "enroll-factor" nocase
        $mfa_skip = "skip_mfa" nocase
        $bypass = "bypass" nocase
    condition:
        any of ($enroll, $mfa_skip, $bypass)
}

Sigma Rule

title: MFA Bypass via Unauthorized Factor Enrollment
id: cve-2025-23017
status: experimental
description: Detects MFA enrollment without prior MFA verification
logsource:
    product: workos
    service: authkit
detection:
    selection:
        event_type: "mfa_factor_enrolled"
    filter:
        event_type: "mfa_verified"
    condition: selection and not filter
falsepositives:
    - Legitimate MFA enrollment after verification (if logging is incomplete)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-23017 MFA Bypass - Unauthorized Factor Enrollment";
    flow:to_server;
    content:"POST"; http_method;
    content:"/enroll-factor"; http_uri;
    content:"factor_type"; http_client_body;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Update WorkOS Hosted AuthKit to the latest version (post-2025-01-07). Contact WorkOS support if unsure.
2. Workaround: If immediate update is not possible, enforce additional verification for MFA enrollment via custom policies or third-party tools.
3. Long-term: Implement server-side validation that requires MFA verification before any factor enrollment. Audit all authentication flows for similar logic flaws.
4. Monitoring: Enable logging for all MFA-related events and set up alerts for anomalous enrollment patterns.
5. User Education: Advise users to report unexpected MFA enrollment notifications.

Valters IT
Securing digital frontiers with precision and expertise.