PT-2023-33074 · Amazon · Aws Cognito

Published 2023-04-18 · Updated 2023-04-18

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Strapi versions 4.5.6 and earlier

Description The issue concerns the verification of access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token signed using the 'None' type algorithm to bypass authentication and impersonate any user using AWS Cognito for authentication. To detect suspicious activity, reviewing application logs is recommended, particularly by extracting ID tokens sent to "/api/auth/cognito/callback" and verifying them using the public key file for the AWS Cognito user pool. If any JWT tokens cannot be verified, inspecting the JWT body for specific claims like email and cognito:username is necessary.

Recommendations For Strapi versions 4.5.6 and earlier, upgrade to Strapi v4.6.0 or greater and reconfigure the AWS Cognito provider to include the JWKS URL to prevent authentication bypass and ensure proper functionality. After upgrading, if you encounter an error message during login due to not reconfiguring your provider, reconfigure your AWS Cognito provider settings accordingly.

Fix

Related Identifiers

GHSA-XV3Q-JRMM-4FXV

Affected Products

Aws Cognito

References · 6

• https://osv.dev/vulnerability/GHSA-xv3q-jrmm-4fxv · Vendor Advisory
• https://github.com/strapi/strapi · Note
• https://github.com/strapi/strapi/releases/tag/v4.6.0 · Note
• https://github.com/strapi/strapi/commit/d0edd25ceb49d275d710bf8d59999a2c07072893 · Note
• https://github.com/strapi/strapi/pull/15382 · Note
• https://github.com/strapi/strapi/security/advisories/GHSA-xv3q-jrmm-4fxv · Note