github - ghsa-583x-23h9-f5w7

ghsa-583x-23h9-f5w7

Vulnerability from github

Published

2023-04-19 18:33

Modified

2023-04-24 18:43

Summary

Strapi does not verify the access or ID tokens issued during the OAuth flow

Details

Strapi 3.2.1 until 4.6.0 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@strapi/plugin-users-permissions"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.2.1"
            },
            {
              "fixed": "4.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-22893"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-24T18:43:51Z",
    "nvd_published_at": "2023-04-19T16:15:07Z",
    "severity": "MODERATE"
  },
  "details": "Strapi 3.2.1 until 4.6.0 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the \u0027None\u0027 type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.",
  "id": "GHSA-583x-23h9-f5w7",
  "modified": "2023-04-24T18:43:51Z",
  "published": "2023-04-19T18:33:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22893"
    },
    {
      "type": "WEB",
      "url": "https://github.com/strapi/strapi/commit/46f8f98378338f18b5c6139d0157a8f71bf4de83"
    },
    {
      "type": "WEB",
      "url": "https://github.com/strapi/strapi/commit/8bbbd7383a20bb7cb163c8b462baffee559e994f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/strapi/strapi/commit/eeab43b57707d7ef275076d27be6eabc72bd71a7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/strapi/strapi"
    },
    {
      "type": "WEB",
      "url": "https://github.com/strapi/strapi/blob/v4.5.6/packages/plugins/users-permissions/server/services/providers-registry.js"
    },
    {
      "type": "WEB",
      "url": "https://github.com/strapi/strapi/releases"
    },
    {
      "type": "WEB",
      "url": "https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve"
    },
    {
      "type": "WEB",
      "url": "https://www.ghostccamm.com/blog/multi_strapi_vulns"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Strapi does not verify the access or ID tokens issued during the OAuth flow"
}

cve-2023-22893

Vulnerability from cvelistv5

Published

2023-04-19 00:00

Modified

2024-08-02 10:20

Severity ?

Summary

Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.

References

▼	URL	Tags
	https://github.com/strapi/strapi/releases
	https://www.ghostccamm.com/blog/multi_strapi_vulns/
	https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T10:20:31.123Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/strapi/strapi/releases"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ghostccamm.com/blog/multi_strapi_vulns/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the \u0027None\u0027 type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-19T00:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/strapi/strapi/releases"
        },
        {
          "url": "https://www.ghostccamm.com/blog/multi_strapi_vulns/"
        },
        {
          "url": "https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-22893",
    "datePublished": "2023-04-19T00:00:00",
    "dateReserved": "2023-01-10T00:00:00",
    "dateUpdated": "2024-08-02T10:20:31.123Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted