PT-2023-25712 · Micronaut · Micronaut Security

Tommyli · Publicado 2023-10-05 · Atualizado 2023-10-13 · CVE-2023-36820

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Micronaut Security versions prior to 3.1.2 Micronaut Security versions prior to 3.2.4 Micronaut Security versions prior to 3.3.2 Micronaut Security versions prior to 3.4.3 Micronaut Security versions prior to 3.5.3 Micronaut Security versions prior to 3.6.6 Micronaut Security versions prior to 3.7.4 Micronaut Security versions prior to 3.8.4 Micronaut Security versions prior to 3.9.6 Micronaut Security versions prior to 3.10.2 Micronaut Security versions prior to 3.11.1

Description IdTokenClaimsValidator skips aud claim validation if token is issued by the same identity issuer/provider. This issue affects any OIDC setup using Micronaut where multiple OIDC applications exist for the same issuer but token auth are not meant to be shared.

Recommendations For versions prior to 3.1.2, upgrade to version 3.1.2 or later. For versions prior to 3.2.4, upgrade to version 3.2.4 or later. For versions prior to 3.3.2, upgrade to version 3.3.2 or later. For versions prior to 3.4.3, upgrade to version 3.4.3 or later. For versions prior to 3.5.3, upgrade to version 3.5.3 or later. For versions prior to 3.6.6, upgrade to version 3.6.6 or later. For versions prior to 3.7.4, upgrade to version 3.7.4 or later. For versions prior to 3.8.4, upgrade to version 3.8.4 or later. For versions prior to 3.9.6, upgrade to version 3.9.6 or later. For versions prior to 3.10.2, upgrade to version 3.10.2 or later. For versions prior to 3.11.1, upgrade to version 3.11.1 or later. As a temporary workaround, consider setting micronaut.security.token.jwt.claims-validators.audience with valid values. If you cannot upgrade, for example, if you are still using Micronaut Framework 2, you can patch your application by creating a replacement of IdTokenClaimsValidatorReplacement.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2023-36820

GHSA-QW22-8W9R-864H

Produtos afetados

Micronaut Security

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36820.json · Exploit
• 🔥 https://github.com/micronaut-projects/micronaut-security/security/advisories/GHSA-qw22-8w9r-864h · Exploit
• https://github.com/micronaut-projects/micronaut-security/commit/9728b925221a0d87798ccf250657a3c214b7e980 · Correção
• https://github.com/micronaut-projects/micronaut-security/blob/master/security-oauth2/src/main/java/io/micronaut/security/oauth2/client/IdTokenClaimsValidator.java#L202 · Nota
• https://github.com/micronaut-projects/micronaut-security · Nota
• https://osv.dev/vulnerability/CVE-2023-36820 · Aviso do Fabricante
• https://t.me/cibsecurity/71841 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-qw22-8w9r-864h · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-36820 · Nota de Segurança