PT-2021-23346 · Unknown · Passport-Oauth2

Ben12385 · Published 2021-09-27 · Updated 2024-08-04 · CVE-2021-41580

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions passport-oauth2 versions prior to 1.6.1

Description The issue concerns the mishandling of the error condition when failing to obtain an access token in certain use cases. Specifically, it is exploitable when an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants authorization upon simply receiving the access token without attempting to use it.

Recommendations For versions prior to 1.6.1, update to version 1.6.1 or later to resolve the issue. As a temporary workaround, consider modifying the application to verify the access token by attempting to use it before granting authorization. Restrict access to the authentication mechanism to minimize the risk of exploitation until the update is applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-41580

GHSA-F794-R6XC-HF3V

Affected Products

Passport-Oauth2

References · 11

• https://github.com/jaredhanson/passport-oauth2/pull/144 · Patch
• https://github.com/jaredhanson/passport-oauth2/commit/8e3bcdff145a2219033bd782fc517229fe3e05ea · Patch
• https://github.com/jaredhanson/passport-oauth2/compare/v1.6.0...v1.6.1 · Patch
• https://osv.dev/vulnerability/CVE-2021-41580 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41580 · Security Note
• https://osv.dev/vulnerability/GHSA-f794-r6xc-hf3v · Vendor Advisory
• https://github.com/jaredhanson/passport-oauth2 · Note
• https://t.me/cvenotify/88905 · Telegram Post
• https://t.me/cvenotify/21486 · Telegram Post
• https://medium.com/passportjs/no-access-token-no-service-7fb017c9e262 · Note
• https://t.me/cibsecurity/29431 · Telegram Post