PT-2024-33666 · Duende · Duende Identityserver

Josephdecock · Published 2024-10-28 · Updated 2024-10-29 · CVE-2024-49755

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Duende IdentityServer versions 7.0.0 through 7.0.7

Description: The local API authentication handler in Duende IdentityServer performs insufficient validation of the cnf claim in DPoP access tokens. This allows an attacker to use leaked DPoP access tokens at local API endpoints even without possessing the private key for signing proof tokens. The issue only impacts custom endpoints within an IdentityServer implementation that have explicitly used the LocalApiAuthenticationHandler for authentication.

Recommendations: For Duende IdentityServer versions 7.0.0 through 7.0.7, update to version 7.0.8 to resolve the issue. As a temporary workaround, consider disabling the use of DPoP for local APIs by configuring the TokenMode option to LocalApiTokenMode.BearerOnly, until a patch is applied. Restrict access to custom endpoints that use the LocalApiAuthenticationHandler to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2024-49755

GHSA-V9XQ-2MVM-X8XC

Affected Products

Duende Identityserver

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49755.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-49755 · Security Note
• https://osv.dev/vulnerability/GHSA-v9xq-2mvm-x8xc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-49755 · Vendor Advisory
• https://github.com/DuendeSoftware/IdentityServer · Note
• https://github.com/DuendeSoftware/IdentityServer/commit/f28cac921c1f545afe65af71a9327224755b6dac · Note
• https://github.com/DuendeSoftware/IdentityServer/security/advisories/GHSA-v9xq-2mvm-x8xc · Note
• https://t.me/cvedetector/9175 · Telegram Post