PT-2023-25864 · Unknown · League/Oauth2-Server

Mhc03 · Published 2023-07-06 · Updated 2023-07-13 · CVE-2023-37260

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions league/oauth2-server versions 8.3.2 through 8.5.2

Description The issue concerns an OAuth 2.0 authorization server written in PHP, where servers that passed their keys to the CryptKey constructor as a string instead of a file path would have the key included in a LogicException message if a valid pass phrase for the key was not provided. This has been patched so that the provided key is no longer exposed in the exception message.

Recommendations For versions 8.3.2 through 8.5.2, upgrade to version 8.5.3 to receive the patch. As a temporary workaround for versions 8.3.2 through 8.5.2, pass the key as a file instead of a string.

Exploit

Fix

Information Disclosure

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-200

CWE-209

Related Identifiers

CVE-2023-37260

GHSA-WJ7Q-GJG8-3CPM

Affected Products

League/Oauth2-Server

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37260.json · Exploit
• https://github.com/thephpleague/oauth2-server/pull/1353 · Patch
• https://github.com/thephpleague/oauth2-server/security/advisories/GHSA-wj7q-gjg8-3cpm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-37260 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37260 · Security Note
• https://osv.dev/vulnerability/GHSA-wj7q-gjg8-3cpm · Vendor Advisory
• https://github.com/thephpleague/oauth2-server/pull/1359 · Note
• https://github.com/thephpleague/oauth2-server · Note
• https://github.com/thephpleague/oauth2-server/releases/tag/8.5.3 · Note
• https://t.me/cibsecurity/66146 · Telegram Post