PT-2020-19715 · Google · Google-Oauth-Client

Published 2020-07-09 · Updated 2024-08-05 · CVE-2020-7692

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions com.google.oauth-client:google-oauth-client versions prior to 1.31.0

Description The issue is related to the implementation of PKCE support for OAuth 2.0 in Native Apps, which does not follow the RFC. This allows an attacker to intercept the authorization code and use it to gain unauthorized access to protected resources. The attacker can obtain the authorization code using a malicious app on the client-side.

Recommendations For versions prior to 1.31.0, update to version 1.31.0 or later to resolve the issue. As a temporary workaround, consider implementing additional security measures to verify the client that issued the initial authorization request, although the exact measures are not specified in the provided information.

Exploit

Fix

Missing Authorization

Incorrect Authorization

Weakness Enumeration

CWE-862

CWE-863

Related Identifiers

CVE-2020-7692

GHSA-F263-C949-W85G

RHSA-2023:0560

RHSA-2023:0777

RHSA-2023:3299

RHSA-2023:6172

RHSA-2024:0778

SNYK-JAVA-COMGOOGLEOAUTHCLIENT-575276

Affected Products

Google-Oauth-Client

References · 20

• 🔥 https://tools.ietf.org/html/rfc8252%23section-8.1 · Exploit
• 🔥 https://tools.ietf.org/html/rfc7636%23section-1 · Exploit
• https://github.com/googleapis/google-oauth-java-client/commit/13433cd7dd06267fc261f0b1d4764f8e3432c824 · Patch
• https://osv.dev/vulnerability/CVE-2020-7692 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-7692 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-7692 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7692 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-7692 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f263-c949-w85g · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-7692 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-7692 · Vendor Advisory
• https://github.com/googleapis/google-oauth-java-client/issues/469 · Note
• https://github.com/googleapis/google-oauth-java-client · Note
• https://t.me/cibsecurity/15039 · Telegram Post
• https://t.me/cvenotify/89296 · Telegram Post