PT-2020-14290 · Ory · Ory Fosite

Jclebreton + 1 · Published 2020-09-24 · Updated 2022-10-21 · CVE-2020-15223

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ORY Fosite versions prior to 0.34.0

Description The issue arises from improper error handling in the TokenRevocationHandler, which ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. An attacker's ability to exploit this relies on the ability to trigger errors in the underlying storage.

Recommendations For versions prior to 0.34.0, update to version 0.34.0 to resolve the issue. As a temporary workaround, consider implementing additional error handling mechanisms for the TokenRevocationHandler to prevent unexpected 200 status codes. Restrict access to the token revocation endpoint to minimize the risk of exploitation until the update is applied.

Fix

Improper Check for Exceptional Conditions

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-754

CWE-755

Related Identifiers

CVE-2020-15223

GHSA-7MQR-2V3Q-V2WM

GO-2021-0109

Affected Products

Ory Fosite

References · 8

• https://github.com/ory/fosite/commit/03dd55813f5521985f7dd64277b7ba0cf1441319 · Patch
• https://osv.dev/vulnerability/GO-2021-0109 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15223 · Security Note
• https://osv.dev/vulnerability/GHSA-7mqr-2v3q-v2wm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15223 · Vendor Advisory
• https://github.com/ory/fosite/security/advisories/GHSA-7mqr-2v3q-v2wm · Note
• https://tools.ietf.org/html/rfc7009#section-2.2.1 · Note
• https://pkg.go.dev/vuln/GO-2021-0109 · Note