Lucene search

GitHub_MCVE-2023-48228

HistoryNov 21, 2023 - 9:15 p.m.

CVE-2023-48228

2023-11-2121:15:08

CWE-287

GitHub_M

web.nvd.nist.gov

authentik

identity provider

cve-2023-48228

oauth2

pkce

security vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.001

Percentile

44.8%

JSON

authentik is an open-source identity provider. When initialising a oauth2 flow with a code_challenge and code_method (thus requesting PKCE), the single sign-on provider (authentik) must check if there is a matching and existing code_verifier during the token step. Prior to versions 2023.10.4 and 2023.8.5, authentik checks if the contents of code_verifier is matching only when it is provided. When it is left out completely, authentik simply accepts the token request with out it; even when the flow was started with a code_challenge. authentik 2023.8.5 and 2023.10.4 fix this issue.

Affected configurations

Nvd

Vulners

Node

goauthentikauthentikRange<2023.8.5

goauthentikauthentikRange2023.10.0–2023.10.4

VendorProductVersionCPE
goauthentikauthentik*cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
goauthentik	authentik	*	cpe:2.3:a:goauthentik:authentik::::::::

CNA Affected

[
  {
    "vendor": "goauthentik",
    "product": "authentik",
    "versions": [
      {
        "version": "< 2023.10.4",
        "status": "affected"
      },
      {
        "version": "< 2023.8.5",
        "status": "affected"
      }
    ]
  }
]

References

github.com/goauthentik/authentik/blob/dd4e9030b4e667d3720be2feda24c08972602274/authentik/providers/oauth2/views/token.py#L225

github.com/goauthentik/authentik/commit/3af77ab3821fe9c7df8055ba5eade3d1ecea03a6

github.com/goauthentik/authentik/commit/6b9afed21f7c39f171a4a445654cfe415bba37d5

github.com/goauthentik/authentik/commit/b88e39411c12e3f9e04125a7887f12354f760a14

github.com/goauthentik/authentik/pull/7666

github.com/goauthentik/authentik/pull/7668

github.com/goauthentik/authentik/pull/7669

github.com/goauthentik/authentik/releases/tag/version%2F2023.10.4

github.com/goauthentik/authentik/releases/tag/version%2F2023.8.5

github.com/goauthentik/authentik/security/advisories/GHSA-fm34-v8xq-f2c3

Social References

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.001

Percentile

44.8%

JSON

Related for CVE-2023-48228