GHSA-7w2c-w47h-789w CVE-2023-34246
Doorkeeper Improper Authentication vulnerability
- Severity
- 4.2 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.72%
- Chance of exploitation in the next 30 days. Higher than 53.80% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-287 Improper Authentication
- Fix
5.6.6- Upgrade doorkeeper to this version or later
Description
OAuth RFC 8252 says https://www.rfc-editor.org/rfc/rfc8252#section-8.6
the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. This includes the case where the user has previously approved an authorization request for a given client id
But Doorkeeper automatically processes authorization requests without user consent for public clients that have been previously approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.
Issue https://github.com/doorkeeper-gem/doorkeeper/issues/1589
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| doorkeeper | < 5.6.6 |
5.6.6 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
doorkeeper RubyGems → 5.6.6
- bundler
bundle update doorkeeper # Gemfile: gem "doorkeeper", ">= 5.6.6"
Severity breakdown
CVSS 3.1 4.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Weakness
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it
- Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
References
Advisories
Packages
Other links
- github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-7w2c-w47h-789w
- github.com/doorkeeper-gem/doorkeeper/issues/1589
- github.com/doorkeeper-gem/doorkeeper/pull/1646
- github.com/doorkeeper-gem/doorkeeper/releases/tag/v5.6.6
- github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2023-34246.yml
- lists.debian.org/debian-lts-announce/2023/07/msg00016.html
- lists.debian.org/debian-lts-announce/2024/12/msg00010.html
- rfc-editor.org/rfc/rfc8252
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-j7vx-8mqj-cqp9 Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper | High | Also affects doorkeeper |
| GHSA-685w-vc84-wxcx Doorkeeper vulnerable to Cross-site Request Forgery | Medium | Also affects doorkeeper |
| GHSA-694m-jhr9-pf77 Doorkeeper subject to Incorrect Permission Assignment | High | Also affects doorkeeper |
| GHSA-hwhh-2fwm-cfgw Doorkeeper is vulnerable to stored XSS and code execution | Medium | Also affects doorkeeper |
| GHSA-3m6r-39p3-jq25 Doorkeeper is vulnerable to replay attacks | Critical | Also affects doorkeeper |
| GHSA-f9x3-7vq9-cph6 Laravel TokenGuard authentication bypass through non-string API credentials | Critical | Same weakness, CWE-287 |
| GHSA-r4xp-prcw-77qf better-auth: OAuth Proxy lets an attacker sign in as another user | Critical | Same weakness, CWE-287 |
| GHSA-965c-763c-88jm better-auth: OAuth state can be used as a Magic Link to sign in as another user | Critical | Same weakness, CWE-287 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor