Headline
GHSA-7w2c-w47h-789w: Doorkeeper Improper Authentication vulnerability
OAuth RFC 8252 says https://www.rfc-editor.org/rfc/rfc8252#section-8.6
the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. This includes the case where the user has previously approved an authorization request for a given client id
But Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.
Issue https://github.com/doorkeeper-gem/doorkeeper/issues/1589
Fix https://github.com/doorkeeper-gem/doorkeeper/pull/1646
Package
bundler doorkeeper (RubyGems)
Affected versions
< 5.6.6
Patched versions
5.6.6
Description
OAuth RFC 8252 says https://www.rfc-editor.org/rfc/rfc8252#section-8.6
the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. This includes the case where the user has previously approved an authorization request for a given client id
But Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.
Issue doorkeeper-gem/doorkeeper#1589
Fix doorkeeper-gem/doorkeeper#1646
References
- GHSA-7w2c-w47h-789w
- https://nvd.nist.gov/vuln/detail/CVE-2023-34246
- doorkeeper-gem/doorkeeper#1589
- doorkeeper-gem/doorkeeper#1646
- https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v5.6.6
- https://www.rfc-editor.org/rfc/rfc8252#section-8.6
nbulaj published to doorkeeper-gem/doorkeeper
Jun 12, 2023
Published to the GitHub Advisory Database
Jun 12, 2023
Reviewed
Jun 12, 2023
Last updated
Jun 12, 2023
Related news
Ubuntu Security Notice 6210-1 - It was discovered that Doorkeeper incorrectly performed authorization checks for public clients that have been previous approved. An attacker could potentially exploit these in order to impersonate another user and obtain sensitive information.
Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.