CVE-2023-34246: Doorkeeper Improper Authentication vulnerability
(updated )
OAuth RFC 8252 says https://www.rfc-editor.org/rfc/rfc8252#section-8.6
the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. This includes the case where the user has previously approved an authorization request for a given client id
But Doorkeeper automatically processes authorization requests without user consent for public clients that have been previously approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.
Issue https://github.com/doorkeeper-gem/doorkeeper/issues/1589
Fix https://github.com/doorkeeper-gem/doorkeeper/pull/1646
References
- github.com/advisories/GHSA-7w2c-w47h-789w
- github.com/doorkeeper-gem/doorkeeper
- github.com/doorkeeper-gem/doorkeeper/issues/1589
- github.com/doorkeeper-gem/doorkeeper/pull/1646
- github.com/doorkeeper-gem/doorkeeper/releases/tag/v5.6.6
- github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-7w2c-w47h-789w
- github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2023-34246.yml
- lists.debian.org/debian-lts-announce/2023/07/msg00016.html
- lists.debian.org/debian-lts-announce/2024/12/msg00010.html
- nvd.nist.gov/vuln/detail/CVE-2023-34246
- www.rfc-editor.org/rfc/rfc8252
Code Behaviors & Features
Detect and mitigate CVE-2023-34246 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →