PT-2024-27952 · Unknown · Pocketbase
Dalurness
·
Published
2024-06-18
·
Updated
2024-07-01
·
CVE-2024-38351
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
PocketBase versions prior to 0.22.14
Description
A malicious user may be able to compromise other user accounts if both OAuth2 and Password auth methods are enabled. The attack scenario involves a malicious actor registering with a targeted user's email, which is unverified, and then the targeted user signing up with OAuth2. The malicious actor can then access the targeted user's account using the initially created email and password. To prevent this, the password is now reset for unverified users when linking OAuth2 accounts. Email alerts are also sent to users who have logged in with a password and have at least one OAuth2 account linked.
Recommendations
Update to version 0.22.14 to fix the issue. As a temporary workaround, consider disabling the OAuth2 auth method or restricting its use until the update is applied. Additionally, users are advised to change their account password immediately if they receive an email alert about unrecognized login activity and do not recognize the action.
Exploit
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pocketbase