Description

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, `SyncClientsManager.register()` calls `updateAccesses(user, ip, false)`, which hits a freeze branch that writes `passwordAttempts` back unchanged. The counter never reaches `USER_MAX_PASSWORD_ATTEMPTS` (10) and the lockout gate never fires. A successful guess returns a `{clientId, clientToken}` pair. The token can be exchanged via `POST /api/app/sync/auth/cookie` for a full JWT. While the code is valid, the attacker can also call `POST /api/auth/2fa/disable` to permanently remove MFA. Version 2.4.0 patches the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-21T20:17:26.993Z",
  "pubdate": "2026-09-21T20:17:26.993Z",
  "executiveSummary": "Sync-in Server versions prior to 2.4.0 contain a critical authentication bypass vulnerability stemming from flawed logic in the TOTP verification process. The vulnerability resides within the `SyncClientsManager.register()` function, which fails to correctly increment or persist the `passwordAttempts` counter during failed multi-factor authentication (MFA) attempts.\nThis flaw effectively disables the account lockout mechanism, allowing an attacker to perform an unlimited brute-force attack against the TOTP verification code. Successful exploitation grants the attacker a valid `clientToken`, which can subsequently be exchanged for a full JWT to gain unauthorized access to the user's account.\nFurthermore, the vulnerability permits the unauthorized invocation of `POST /api/auth/2fa/disable`, enabling an attacker to permanently disable MFA for a compromised account. The lack of account lockout enforcement poses a severe risk to data integrity and confidentiality, as it bypasses standard security controls for user authentication. The vulnerability is exploitable remotely and requires only knowledge of valid user credentials to initiate the MFA verification flow.",
  "technicalDetails": "The vulnerability is rooted in an logic error within the `SyncClientsManager.register()` function during the handling of failed TOTP verification attempts in `POST /api/app/sync/register`. When a user provides incorrect TOTP credentials, the application invokes `updateAccesses(user, ip, false)`.\nAnalysis of the code reveals that this call enters a branch intended to enforce security policy, yet it fails to correctly update the `passwordAttempts` state. Specifically, the system writes the `passwordAttempts` counter back to the database in an unchanged state regardless of the failure. Consequently, the counter never reaches the `USER_MAX_PASSWORD_ATTEMPTS` threshold (set to 10), causing the internal lockout gate to remain permanently inactive.\nThe exploitation flow follows these steps: 1) The attacker obtains valid user credentials. 2) The attacker initiates the registration of a new desktop sync client via `POST /api/app/sync/register` using valid credentials and an incorrect TOTP code. 3) Due to the failure to increment the lockout counter, the attacker can programmatically iterate through all possible 6-digit TOTP codes without triggering a lockout or account suspension. 4) Upon successful discovery of the correct TOTP code, the server returns a `{clientId, clientToken}` pair.\nPost-exploitation, the attacker performs a second operation: exchanging the obtained `clientToken` via `POST /api/app/sync/auth/cookie` to receive a fully privileged JWT. Additionally, the attacker can leverage the authenticated session to call `POST /api/auth/2fa/disable`. Because the MFA requirement is functionally bypassed during the registration flow, the attacker can permanently strip the target account of its second-factor protection, ensuring long-term persistence even if the original credentials are changed.\nThe flaw affects all deployments of Sync-in Server prior to version 2.4.0. The attack surface is exposed via standard network-accessible API endpoints, requiring no specific administrative privileges other than the ability to initiate the sync registration process. The lack of rate limiting or proper lockout enforcement against the MFA verification logic effectively renders the TOTP implementation moot against a motivated, automated attacker."
}