PT-2024-18984 · Rubygems · Omniauth-Microsoft Graph

Makuga01 · Published 2024-01-02 · Updated 2024-01-09 · CVE-2024-21632

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions omniauth-microsoft graph versions prior to 2.0.0

Description The implementation did not validate the legitimacy of the email attribute of the user nor did it give or document an option to do so, making it susceptible to nOAuth misconfiguration in cases when the email is used as a trusted user identifier. This could lead to account takeover.

Recommendations For versions prior to 2.0.0, update to version 2.0.0 to resolve the issue. As a temporary workaround, consider validating the legitimacy of the email attribute manually until a patch is applied. Restrict the use of the email attribute as a trusted user identifier to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2024-21632

GHSA-5G66-628F-7CVJ

Affected Products

Omniauth-Microsoft Graph

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21632.json · Exploit
• 🔥 https://descope.com/blog/post/noauth · Exploit
• https://github.com/synth/omniauth-microsoft_graph/security/advisories/GHSA-5g66-628f-7cvj · Vendor Advisory
• https://github.com/synth/omniauth-microsoft_graph/commit/f132078389612b797c872b45bd0e0b47382414c1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-21632 · Security Note
• https://osv.dev/vulnerability/GHSA-5g66-628f-7cvj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21632 · Vendor Advisory
• https://github.com/synth/omniauth-microsoft_graph/commit/5ffd62690ca0e46978f2fc7d83b18d28edde7795 · Note
• https://github.com/synth/omniauth-microsoft_graph · Note
• https://twitter.com/CVEnew/status/1742308368285360196 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1742330365115547761 · Twitter Post
• https://t.me/cibsecurity/74215 · Telegram Post
• https://t.me/cvenotify/66780 · Telegram Post