Search criteria
3 vulnerabilities by powauth
CVE-2023-42446 (GCVE-0-2023-42446)
Vulnerability from cvelistv5 – Published: 2023-09-18 21:29 – Updated: 2024-09-24 18:11
VLAI?
Title
Pow Mnesia cache doesn't invalidate all expired keys on startup
Summary
Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of `Pow.Store.Backend.MnesiaCache` is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expire when all `Pow.Store.Backend.MnesiaCache` instances have been shut down for a period that is longer than a session's remaining TTL. Version 1.0.34 contains a patch for this issue. As a workaround, expired keys, including all expired sessions, can be manually invalidated.
Severity ?
6.5 (Medium)
CWE
- CWE-298 - Improper Validation of Certificate Expiration
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:23:38.521Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/pow-auth/pow/security/advisories/GHSA-3cjh-p6pw-jhv9",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/pow-auth/pow/security/advisories/GHSA-3cjh-p6pw-jhv9"
},
{
"name": "https://github.com/pow-auth/pow/issues/713",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pow-auth/pow/issues/713"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-42446",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-24T18:00:47.957433Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-24T18:11:16.178Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pow",
"vendor": "pow-auth",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.14, \u003c 1.0.34"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of `Pow.Store.Backend.MnesiaCache` is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expire when all `Pow.Store.Backend.MnesiaCache` instances have been shut down for a period that is longer than a session\u0027s remaining TTL. Version 1.0.34 contains a patch for this issue. As a workaround, expired keys, including all expired sessions, can be manually invalidated."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-298",
"description": "CWE-298: Improper Validation of Certificate Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-18T21:29:22.133Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pow-auth/pow/security/advisories/GHSA-3cjh-p6pw-jhv9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pow-auth/pow/security/advisories/GHSA-3cjh-p6pw-jhv9"
},
{
"name": "https://github.com/pow-auth/pow/issues/713",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pow-auth/pow/issues/713"
}
],
"source": {
"advisory": "GHSA-3cjh-p6pw-jhv9",
"discovery": "UNKNOWN"
},
"title": "Pow Mnesia cache doesn\u0027t invalidate all expired keys on startup"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-42446",
"datePublished": "2023-09-18T21:29:22.133Z",
"dateReserved": "2023-09-08T20:57:45.572Z",
"dateUpdated": "2024-09-24T18:11:16.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-5205 (GCVE-0-2020-5205)
Vulnerability from cvelistv5 – Published: 2020-01-09 02:05 – Updated: 2024-08-04 08:22
VLAI?
Title
Session fixation attack in Pow (Hex package)
Summary
In Pow (Hex package) before 1.0.16, the use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database. Cookie store, which is used in most Phoenix apps, doesn't have this vulnerability.
Severity ?
6.5 (Medium)
CWE
- CWE-384 - Session Fixation
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| danschultzer | Pow |
Affected:
< 1.0.16
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:22:08.880Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/danschultzer/pow/security/advisories/GHSA-v2wf-c3j6-wpvw"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/danschultzer/pow/commit/578ffd3d8bb8e8a26077b644222186b108da474f"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/danschultzer/pow/blob/master/CHANGELOG.md#v1016-2020-01-07"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Pow",
"vendor": "danschultzer",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.16"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Pow (Hex package) before 1.0.16, the use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database. Cookie store, which is used in most Phoenix apps, doesn\u0027t have this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-384",
"description": "CWE-384 Session Fixation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-09T02:05:13",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/danschultzer/pow/security/advisories/GHSA-v2wf-c3j6-wpvw"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/danschultzer/pow/commit/578ffd3d8bb8e8a26077b644222186b108da474f"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/danschultzer/pow/blob/master/CHANGELOG.md#v1016-2020-01-07"
}
],
"source": {
"advisory": "GHSA-v2wf-c3j6-wpvw",
"discovery": "UNKNOWN"
},
"title": "Session fixation attack in Pow (Hex package)",
"workarounds": [
{
"lang": "en",
"value": "Call Plug.Conn.configure_session(conn, renew: true) periodically and after privilege change. A custom authorization plug can be written where the create/3 method should return the conn only after Plug.Conn.configure_session/2 have been called on it."
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2020-5205",
"STATE": "PUBLIC",
"TITLE": "Session fixation attack in Pow (Hex package)"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Pow",
"version": {
"version_data": [
{
"version_value": "\u003c 1.0.16"
}
]
}
}
]
},
"vendor_name": "danschultzer"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Pow (Hex package) before 1.0.16, the use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database. Cookie store, which is used in most Phoenix apps, doesn\u0027t have this vulnerability."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-384 Session Fixation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/danschultzer/pow/security/advisories/GHSA-v2wf-c3j6-wpvw",
"refsource": "CONFIRM",
"url": "https://github.com/danschultzer/pow/security/advisories/GHSA-v2wf-c3j6-wpvw"
},
{
"name": "https://github.com/danschultzer/pow/commit/578ffd3d8bb8e8a26077b644222186b108da474f",
"refsource": "MISC",
"url": "https://github.com/danschultzer/pow/commit/578ffd3d8bb8e8a26077b644222186b108da474f"
},
{
"name": "https://github.com/danschultzer/pow/blob/master/CHANGELOG.md#v1016-2020-01-07",
"refsource": "MISC",
"url": "https://github.com/danschultzer/pow/blob/master/CHANGELOG.md#v1016-2020-01-07"
}
]
},
"source": {
"advisory": "GHSA-v2wf-c3j6-wpvw",
"discovery": "UNKNOWN"
},
"work_around": [
{
"lang": "en",
"value": "Call Plug.Conn.configure_session(conn, renew: true) periodically and after privilege change. A custom authorization plug can be written where the create/3 method should return the conn only after Plug.Conn.configure_session/2 have been called on it."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2020-5205",
"datePublished": "2020-01-09T02:05:14",
"dateReserved": "2020-01-02T00:00:00",
"dateUpdated": "2024-08-04T08:22:08.880Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-16764 (GCVE-0-2019-16764)
Vulnerability from cvelistv5 – Published: 2019-11-25 17:11 – Updated: 2024-08-05 01:24
VLAI?
Title
PowAssent is susceptible to denial of service attacks
Summary
The use of `String.to_atom/1` in PowAssent is susceptible to denial of service attacks. In `PowAssent.Phoenix.AuthorizationController` a value is fetched from the user provided params, and `String.to_atom/1` is used to convert the binary value to an atom so it can be used to fetch the provider configuration value. This is unsafe as it is user provided data, and can be used to fill up the whole atom table of ~1M which will cause the app to crash.
Severity ?
6.5 (Medium)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| pow-auth | pow_assent |
Affected:
< 0.4.4 , < 0.4.4
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T01:24:47.215Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/pow-auth/pow_assent/security/advisories/GHSA-368c-xvrv-x986"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://hex.pm/packages/pow_assent"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://erlang.org/doc/efficiency_guide/commoncaveats.html#list_to_atom-1"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pow-auth/pow_assent/commit/026105eeecc0e3c2f807e7109e745ea93c0fd9cf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "pow_assent",
"vendor": "pow-auth",
"versions": [
{
"lessThan": "0.4.4",
"status": "affected",
"version": "\u003c 0.4.4",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The use of `String.to_atom/1` in PowAssent is susceptible to denial of service attacks. In `PowAssent.Phoenix.AuthorizationController` a value is fetched from the user provided params, and `String.to_atom/1` is used to convert the binary value to an atom so it can be used to fetch the provider configuration value. This is unsafe as it is user provided data, and can be used to fill up the whole atom table of ~1M which will cause the app to crash."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-25T17:11:19",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pow-auth/pow_assent/security/advisories/GHSA-368c-xvrv-x986"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://hex.pm/packages/pow_assent"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://erlang.org/doc/efficiency_guide/commoncaveats.html#list_to_atom-1"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pow-auth/pow_assent/commit/026105eeecc0e3c2f807e7109e745ea93c0fd9cf"
}
],
"source": {
"advisory": "GHSA-368c-xvrv-x986",
"discovery": "UNKNOWN"
},
"title": "PowAssent is susceptible to denial of service attacks",
"workarounds": [
{
"lang": "en",
"value": "A plug can be used to validate conn.params[\u0026quot;provider\u0026quot;] before it reaches the PowAssent.Phoenix.AuthorizationController."
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2019-16764",
"STATE": "PUBLIC",
"TITLE": "PowAssent is susceptible to denial of service attacks"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "pow_assent",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "\u003c 0.4.4",
"version_value": "0.4.4"
}
]
}
}
]
},
"vendor_name": "pow-auth"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The use of `String.to_atom/1` in PowAssent is susceptible to denial of service attacks. In `PowAssent.Phoenix.AuthorizationController` a value is fetched from the user provided params, and `String.to_atom/1` is used to convert the binary value to an atom so it can be used to fetch the provider configuration value. This is unsafe as it is user provided data, and can be used to fill up the whole atom table of ~1M which will cause the app to crash."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-400 Uncontrolled Resource Consumption"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/pow-auth/pow_assent/security/advisories/GHSA-368c-xvrv-x986",
"refsource": "CONFIRM",
"url": "https://github.com/pow-auth/pow_assent/security/advisories/GHSA-368c-xvrv-x986"
},
{
"name": "https://hex.pm/packages/pow_assent",
"refsource": "MISC",
"url": "https://hex.pm/packages/pow_assent"
},
{
"name": "http://erlang.org/doc/efficiency_guide/commoncaveats.html#list_to_atom-1",
"refsource": "MISC",
"url": "http://erlang.org/doc/efficiency_guide/commoncaveats.html#list_to_atom-1"
},
{
"name": "https://github.com/pow-auth/pow_assent/commit/026105eeecc0e3c2f807e7109e745ea93c0fd9cf",
"refsource": "MISC",
"url": "https://github.com/pow-auth/pow_assent/commit/026105eeecc0e3c2f807e7109e745ea93c0fd9cf"
}
]
},
"source": {
"advisory": "GHSA-368c-xvrv-x986",
"discovery": "UNKNOWN"
},
"work_around": [
{
"lang": "en",
"value": "A plug can be used to validate conn.params[\u0026quot;provider\u0026quot;] before it reaches the PowAssent.Phoenix.AuthorizationController."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2019-16764",
"datePublished": "2019-11-25T17:11:19",
"dateReserved": "2019-09-24T00:00:00",
"dateUpdated": "2024-08-05T01:24:47.215Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}