GitHub Advisoryadvisory · RubyGems
GHSA-7w2c-w47h-789w Doorkeeper Improper Authentication vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2023-34246
- Ecosystem
- RubyGems
- Packages
- doorkeeper
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-287
- Reviewed
- 2023-06-12
Affected packages
• RubyGems doorkeeper: < 5.6.6 → fixed in 5.6.6
Description
OAuth RFC 8252 says https://www.rfc-editor.org/rfc/rfc8252#section-8.6
> the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. This includes the case where the user has previously approved an authorization request for a given client id
But Doorkeeper automatically processes authorization requests without user consent for public clients that have been previously approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.
Issue https://github.com/doorkeeper-gem/doorkeeper/issues/1589
Fix https://github.com/doorkeeper-gem/doorkeeper/pull/1646
Related
Alias · CVE (1)
- CVE-2023-34246 Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. vulnerability
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-7w2c-w47h-789w web
- https://nvd.nist.gov/vuln/detail/CVE-2023-34246 advisory
- https://github.com/doorkeeper-gem/doorkeeper/issues/1589 web
- https://github.com/doorkeeper-gem/doorkeeper/pull/1646 web
- https://github.com/doorkeeper-gem/doorkeeper package
- https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v5.6.6 web
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2023-34246.yml web
- https://lists.debian.org/debian-lts-announce/2023/07/msg00016.html web
- https://lists.debian.org/debian-lts-announce/2024/12/msg00010.html web
- https://www.rfc-editor.org/rfc/rfc8252#section-8.6 web