PT-2020-14305 · Auth0 · Omniauth-Auth0

Highlzychowski · Published 2020-10-21 · Updated 2021-11-18 · CVE-2020-15240

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions omniauth-auth0 versions 2.3.0 through 2.4.0

Description The issue concerns improper validation of the JWT token signature when using the jwt validator.verify method, potentially allowing an attacker to bypass authentication and authorization. This affects users of omniauth-auth0 who either use the JWTValidator.verify method directly or do not authenticate using the SDK's default Authorization Code Flow.

Recommendations For omniauth-auth0 versions 2.3.0 through 2.4.0, upgrade to version 2.4.1 to resolve the issue. As a temporary workaround, consider avoiding the use of the JWTValidator.verify method directly and instead use the SDK's default Authorization Code Flow for authentication.

Exploit

Fix

Improper Authentication

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-287

CWE-347

Related Identifiers

CVE-2020-15240

GHSA-58R4-H6V8-JCVM

Affected Products

Omniauth-Auth0

References · 8

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-auth0/CVE-2020-15240.yml · Exploit
• https://github.com/auth0/omniauth-auth0/commit/fd3a14f4ccdfbc515d1121d6378ff88bf55a7a7a · Patch
• https://rubygems.org/gems/omniauth-auth0 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15240 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15240 · Security Note
• https://osv.dev/vulnerability/GHSA-58r4-h6v8-jcvm · Vendor Advisory
• https://github.com/auth0/omniauth-auth0/security/advisories/GHSA-58r4-h6v8-jcvm · Note
• https://github.com/auth0/omniauth-auth0 · Note