PT-2023-33074 · Amazon · Aws Cognito

Publicado 2023-04-18 · Atualizado 2023-04-18

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Strapi versions 4.5.6 and earlier

Description The issue concerns the verification of access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token signed using the 'None' type algorithm to bypass authentication and impersonate any user using AWS Cognito for authentication. To detect suspicious activity, reviewing application logs is recommended, particularly by extracting ID tokens sent to "/api/auth/cognito/callback" and verifying them using the public key file for the AWS Cognito user pool. If any JWT tokens cannot be verified, inspecting the JWT body for specific claims like email and cognito:username is necessary.

Recommendations For Strapi versions 4.5.6 and earlier, upgrade to Strapi v4.6.0 or greater and reconfigure the AWS Cognito provider to include the JWKS URL to prevent authentication bypass and ensure proper functionality. After upgrading, if you encounter an error message during login due to not reconfiguring your provider, reconfigure your AWS Cognito provider settings accordingly.

Correção

Identificadores relacionados

GHSA-XV3Q-JRMM-4FXV

Produtos afetados

Aws Cognito

Referências · 6

• https://github.com/strapi/strapi · Nota
• https://github.com/strapi/strapi/pull/15382 · Nota
• https://github.com/strapi/strapi/commit/d0edd25ceb49d275d710bf8d59999a2c07072893 · Nota
• https://github.com/strapi/strapi/releases/tag/v4.6.0 · Nota
• https://github.com/strapi/strapi/security/advisories/GHSA-xv3q-jrmm-4fxv · Nota
• https://osv.dev/vulnerability/GHSA-xv3q-jrmm-4fxv · Aviso do Fabricante