PT-2020-14289 · Ory · Ory Fosite

Published 2020-09-24 · Updated 2021-11-18 · CVE-2020-15222

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ORY Fosite versions prior to 0.31.0

Description The uniqueness of the jti value is not checked when using "private key jwt" authentication. According to the OpenId specification, the jti assertion must be unique to prevent token reuse. However, Hydra does not seem to check the uniqueness of this jti value, allowing the token to be replayed.

Recommendations For versions prior to 0.31.0, update to version 0.31.0 to fix the issue. As a temporary workaround, consider disabling the use of "private key jwt" authentication method until a patch is available. Restrict access to clients using "private key jwt" to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-287

CWE-345

Related Identifiers

CVE-2020-15222

GHSA-V3Q9-2P3M-7G43

GO-2021-0110

Affected Products

Ory Fosite

References · 10

• 🔥 https://github.com/ory/fosite/security/advisories/GHSA-v3q9-2p3m-7g43 · Exploit
• https://github.com/ory/fosite/commit/0c9e0f6d654913ad57c507dd9a36631e1858a3e9 · Patch
• https://osv.dev/vulnerability/CVE-2020-15222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15222 · Security Note
• https://osv.dev/vulnerability/GO-2021-0110 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v3q9-2p3m-7g43 · Vendor Advisory
• https://github.com/ory/fosite · Note
• https://github.com/ory/fosite/releases/tag/v0.31.0 · Note
• https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication · Note
• https://pkg.go.dev/vuln/GO-2021-0110 · Note