PT-2023-25712 · Micronaut · Micronaut Security

Tommyli · Published 2023-10-05 · Updated 2023-10-13 · CVE-2023-36820

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Micronaut Security versions prior to 3.1.2 Micronaut Security versions prior to 3.2.4 Micronaut Security versions prior to 3.3.2 Micronaut Security versions prior to 3.4.3 Micronaut Security versions prior to 3.5.3 Micronaut Security versions prior to 3.6.6 Micronaut Security versions prior to 3.7.4 Micronaut Security versions prior to 3.8.4 Micronaut Security versions prior to 3.9.6 Micronaut Security versions prior to 3.10.2 Micronaut Security versions prior to 3.11.1

Description IdTokenClaimsValidator skips aud claim validation if token is issued by the same identity issuer/provider. This issue affects any OIDC setup using Micronaut where multiple OIDC applications exist for the same issuer but token auth are not meant to be shared.

Recommendations For versions prior to 3.1.2, upgrade to version 3.1.2 or later. For versions prior to 3.2.4, upgrade to version 3.2.4 or later. For versions prior to 3.3.2, upgrade to version 3.3.2 or later. For versions prior to 3.4.3, upgrade to version 3.4.3 or later. For versions prior to 3.5.3, upgrade to version 3.5.3 or later. For versions prior to 3.6.6, upgrade to version 3.6.6 or later. For versions prior to 3.7.4, upgrade to version 3.7.4 or later. For versions prior to 3.8.4, upgrade to version 3.8.4 or later. For versions prior to 3.9.6, upgrade to version 3.9.6 or later. For versions prior to 3.10.2, upgrade to version 3.10.2 or later. For versions prior to 3.11.1, upgrade to version 3.11.1 or later. As a temporary workaround, consider setting micronaut.security.token.jwt.claims-validators.audience with valid values. If you cannot upgrade, for example, if you are still using Micronaut Framework 2, you can patch your application by creating a replacement of IdTokenClaimsValidatorReplacement.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2023-36820

GHSA-QW22-8W9R-864H

Affected Products

Micronaut Security

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36820.json · Exploit
• 🔥 https://github.com/micronaut-projects/micronaut-security/security/advisories/GHSA-qw22-8w9r-864h · Exploit
• https://github.com/micronaut-projects/micronaut-security/commit/9728b925221a0d87798ccf250657a3c214b7e980 · Patch
• https://osv.dev/vulnerability/CVE-2023-36820 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qw22-8w9r-864h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36820 · Security Note
• https://github.com/micronaut-projects/micronaut-security/blob/master/security-oauth2/src/main/java/io/micronaut/security/oauth2/client/IdTokenClaimsValidator.java#L202 · Note
• https://github.com/micronaut-projects/micronaut-security · Note
• https://t.me/cibsecurity/71841 · Telegram Post