PT-2021-19867 · Ory · Ory Oathkeeper
Aeneasr
+1
·
Published
2021-06-22
·
Updated
2024-08-21
·
CVE-2021-32701
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
ORY Oathkeeper versions prior to v0.38.12-beta.1
Description
The issue arises when a request is made to an endpoint requiring a specific scope, and the access token is granted with that scope, making introspection valid and caching the token. If a second request is made to an endpoint requiring a different scope before the cache expires, introspection will be valid regardless of whether the token is granted the new scope. The cache only validates the token's expiration date, ignoring whether the token has the proper scopes. This vulnerability was introduced due to insufficient test coverage during a code review.
Recommendations
To resolve the issue, update to version v0.38.12-beta.1 or later.
As a temporary workaround, consider disabling caching for the
oauth2 introspection authenticator, as this vulnerability does not exist when caching is disabled.
Restrict access to the vulnerable AuthenticatorOAuth2Introspection function until a patch is available.
Avoid using the tokenFromCache() function until the issue is resolved.
Disable the cache when the scope strategy is none and the requested scope is not empty to prevent the cache from being used.Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ory Oathkeeper