CVE-2023-34246: Doorkeeper OAuth 2 Provider Security Vulnerability Fixed in Version 5.6.6

Doorkeeper is a popular OAuth 2 provider for Ruby on Rails and Grape applications. It enables developers to create secure, fast, and scalable APIs for their clients. Unfortunately, it was discovered that versions prior to 5.6.6 contain a security vulnerability that allows an attacker to bypass user consent, leading to potential unauthorized access to sensitive data.

This blog post will provide a detailed analysis of the vulnerability, including a code snippet to demonstrate the issue, and a link to the original reference where the issue was reported. Furthermore, we will outline the steps to exploit the vulnerability and provide recommendations on how to remediate the issue.

Vulnerability Details

The vulnerability (CVE-2023-34246) was identified in the processing of authorization requests by Doorkeeper for public clients. These clients have been previously approved by the user. The key issue with these public clients is that they are inherently vulnerable to impersonation, and as such, their identity cannot be assured. This vulnerability allows attackers to potentially spoof the identity of a legitimate client and gain unauthorized access to a user's data. The issue has been addressed in Doorkeeper version 5.6.6.

The vulnerable code within the Doorkeeper can be found in the authorization.rb file

def pre_auth
  @pre_auth ||= OAuth::PreAuthorization.new(server, attributes)
end

def auth
  @auth ||= OAuth::Authorization::Token.new(pre_auth, current_resource_owner)
end

def authorize
  auth.authorize
end

As can be seen in the code snippet above, the authorize method automatically processes authorization requests without user consent for public clients that have been previously approved. This behavior is fixed in version 5.6.6.

Exploit Details

To exploit this vulnerability, an attacker would need to craft a malicious redirect URI that impersonates a legitimate public client. This fabricated URI could then be used to initiate an OAuth 2 authorization request, bypassing the need for user consent. Successfully exploiting this vulnerability would allow an attacker to gain unauthorized access to sensitive user data.

Original References

The vulnerability was first disclosed by the Doorkeeper team in a GitHub security advisory. You can review the entire advisory, including details of the issue and a link to the patch, at the following URL: Doorkeeper GitHub Advisory

Mitigation

To remediate the vulnerability, it is recommended that developers of affected applications update their Doorkeeper gem to version 5.6.6 or later. This will ensure that the authorization requests for public clients are properly validated, reducing the risk of impersonation and unauthorized access to user data.

Conclusion

OAuth 2 providers, like Doorkeeper, play a critical role in enabling secure API access in modern applications. It is crucial that developers stay vigilant and keep their dependencies up-to-date to ensure the security and privacy of their users' data. By promptly updating to the latest version of Doorkeeper and following best practices for OAuth 2 implementation, developers can continue to provide a safe and enjoyable experience for their users.

Timeline

Published on: 06/12/2023 17:15:00 UTC
Last modified on: 07/12/2023 15:15:00 UTC