PT-2024-35077 · Duende · Duende.Accesstokenmanagement.Openidconnect

Natelaff · Published 2024-11-07 · Updated 2024-11-08 · CVE-2024-51987

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Duende.AccessTokenManagement.OpenIdConnect versions prior to 3.0.1

Description Duende.AccessTokenManagement.OpenIdConnect is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. HTTP Clients created by AddUserAccessTokenHttpClient may use a different user's access token after a token refresh occurs. This occurs because a refreshed token will be captured in pooled HttpClient instances, which may be used by a different user. Instead of using AddUserAccessTokenHttpClient to create an HttpClient that automatically adds a managed token to outgoing requests, you can use the HttpConext.GetUserAccessTokenAsync extension method or the IUserTokenManagementService.GetAccessTokenAsync method.

Recommendations For versions prior to 3.0.1, upgrade to Duende.AccessTokenManagement.OpenIdConnect 3.0.1 to fix the issue. As a temporary workaround, consider using the HttpConext.GetUserAccessTokenAsync extension method or the IUserTokenManagementService.GetAccessTokenAsync method instead of AddUserAccessTokenHttpClient to create an HttpClient that automatically adds a managed token to outgoing requests.

Exploit

Fix

Weakness Enumeration

CWE-270

Related Identifiers

CVE-2024-51987

GHSA-7MR7-4F54-VCX5

Affected Products

Duende.Accesstokenmanagement.Openidconnect

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51987.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-51987 · Security Note
• https://osv.dev/vulnerability/GHSA-7mr7-4f54-vcx5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-51987 · Vendor Advisory
• https://github.com/DuendeSoftware/Duende.AccessTokenManagement/releases/tag/3.0.1 · Note
• https://github.com/DuendeSoftware/Duende.AccessTokenManagement · Note
• https://github.com/DuendeSoftware/Duende.AccessTokenManagement/commit/09c73e32b182da5c6d7b55ec790cb2271cc4b63f · Note
• https://github.com/DuendeSoftware/Duende.AccessTokenManagement/security/advisories/GHSA-7mr7-4f54-vcx5 · Note
• https://t.me/cvenotify/101003 · Telegram Post
• https://twitter.com/CVEnew/status/1854670340766535867 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1854729218317263097 · Twitter Post
• https://t.me/cvedetector/10147 · Telegram Post