CVE-2023-34246 – doorkeeper

Package

Manager: gem
Name: doorkeeper
Vulnerable Version: >=0 <5.6.6

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00376 pctl0.58384

Details

Doorkeeper Improper Authentication vulnerability OAuth RFC 8252 says https://www.rfc-editor.org/rfc/rfc8252#section-8.6 > the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. **This includes the case where the user has previously approved an authorization request for a given client id** But Doorkeeper automatically processes authorization requests without user consent for public clients that have been previously approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. Issue https://github.com/doorkeeper-gem/doorkeeper/issues/1589 Fix https://github.com/doorkeeper-gem/doorkeeper/pull/1646

Metadata

Created: 2023-06-12T19:50:34Z
Modified: 2024-12-09T06:30:55Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-7w2c-w47h-789w/GHSA-7w2c-w47h-789w.json
CWE IDs: ["CWE-287"]
Alternative ID: GHSA-7w2c-w47h-789w
Finding: F039
Auto approve: 1