Information disclosure vulnerability. Allows an attacker to see all Doorkeeper::Application
model attribute values (including secrets) using authorized applications controller if it’s enabled (GET /oauth/authorized_applications.json).
These versions have the fix:
Patch Doorkeeper::Application
model #as_json(options = {})
method and define only those attributes you want to expose.
Additional recommended hardening is to enable application secrets hashing (guide), available since Doorkeeper 5.1. This would render the exposed secret useless.
CPE | Name | Operator | Version |
---|---|---|---|
doorkeeper | eq | 5.2.2 | |
doorkeeper | eq | 5.2.3 | |
doorkeeper | eq | 5.2.1 | |
doorkeeper | eq | 5.1.0 | |
doorkeeper | eq | 5.3.1 | |
doorkeeper | eq | 5.2.4 | |
doorkeeper | eq | 5.3.0 | |
doorkeeper | eq | 5.0.1 | |
doorkeeper | eq | 5.2.0 | |
doorkeeper | eq | 5.0.0 |
github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6
github.com/doorkeeper-gem/doorkeeper/releases
github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-j7vx-8mqj-cqp9
github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2020-10187.yml
github.com/rubysec/ruby-advisory-db/pull/446
nvd.nist.gov/vuln/detail/CVE-2020-10187