CVE-2017-18924: Improper Control of Generation of Code ('Code Injection')
** DISPUTED ** oauth2-server (aka node-oauth2-server) implements OAuth without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states ‘As RFC7636 is an extension, I think the claim in the Readme of “RFC compliant” is valid and not misleading and I also therefore wouldn’t describe this as a “vulnerability” with the library per se.’
References
- codeburst.io/missing-the-point-in-securing-oauth-2-0-83968708b467
- github.com/advisories/GHSA-2fw4-mgq9-39cx
- github.com/oauthjs/node-oauth2-server/issues/637
- github.com/oauthjs/node-oauth2-server/pull/452
- nvd.nist.gov/vuln/detail/CVE-2017-18924
- tools.ietf.org/html/draft-ietf-oauth-security-topics-15
- tools.ietf.org/html/rfc7636
Code Behaviors & Features
Detect and mitigate CVE-2017-18924 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →