PT-2021-1610 · Microsoft · Bot Framework Sdk

Published 2021-01-12 · Updated 2024-10-08 · CVE-2021-1725

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Bot Framework SDK versions prior to the fixed version

Description The vulnerability is related to the lack of protection of service data in the Bot Framework SDK. It may allow a remote attacker to gain unauthorized access to protected information. A maliciously crafted claim may be incorrectly authenticated by the bot, impacting bots that are not configured to be used as a Skill. This issue requires an attacker to have internal knowledge of the bot.

Recommendations For versions prior to the fixed version, update to a patched version. As a temporary workaround, consider adding an authentication configuration containing ClaimsValidator, which throws an exception if Claims are Skill Claims. Restrict access to potentially vulnerable bots to minimize the risk of exploitation.

Fix

Improper Authentication

Information Disclosure

Weakness Enumeration

CWE-287

CWE-200

Related Identifiers

BDU:2021-00263

CVE-2021-1725

GHSA-CQFF-FX2X-P86V

GHSA-FVCJ-HVFW-7F2V

PYSEC-2021-422

Affected Products

Bot Framework Sdk

References · 17

• https://bdu.fstec.ru/vul/2021-00263 · Security Note
• https://osv.dev/vulnerability/GHSA-cqff-fx2x-p86v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1725 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1725 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fvcj-hvfw-7f2v · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-422 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1725 · Vendor Advisory
• https://github.com/microsoft/botbuilder-python/blob/main/doc/SkillClaimsValidation.md · Note
• https://github.com/microsoft/botbuilder-python/security/advisories/GHSA-cqff-fx2x-p86v · Note
• https://github.com/microsoft/botbuilder-js · Note
• https://github.com/microsoft/botbuilder-js/security/advisories/GHSA-fvcj-hvfw-7f2v · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/botframework-connector/PYSEC-2021-422.yaml · Note
• https://t.me/cvenotify/65723 · Telegram Post
• https://aka.ms/SkillClaimsValidationJavascript · Note
• https://pypi.org/project/botframework-connector · Note