CVE-2022-39222
published 2022-10-06CVE-2022-39222: Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients…
PriorityP334medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
EPSS
1.13%
62.3th percentile
Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients accepting tokens issued by those Dex instances) are affected by this vulnerability if they are running a version prior to 2.35.0. An attacker can exploit this vulnerability by making a victim navigate to a malicious website and guiding them through the OIDC flow, stealing the OAuth authorization code in the process. The authorization code then can be exchanged by the attacker for a token, gaining access to applications accepting that token. Version 2.35.0 has introduced a fix for this issue. Users are advised to upgrade. There are no known workarounds for this issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dexidp | dex | < 2.35.0 | 2.35.0 |
| github.com | dexidp_dex | >= 0 < 2.35.0 | 2.35.0 |
| linuxfoundation | dex | < 2.35.0 | 2.35.0 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
vendor_redhat9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Dex vulnerable to Man-in-the-Middle allowing ID token capture via intercepted authorization code
osv·2022-10-03
CVE-2022-39222 [CRITICAL] Dex vulnerable to Man-in-the-Middle allowing ID token capture via intercepted authorization code
Dex vulnerable to Man-in-the-Middle allowing ID token capture via intercepted authorization code
### Impact
Dex instances with public clients (and by extension, clients accepting tokens issued by those Dex instances) are affected by this vulnerability.
An attacker can exploit this vulnerability by making a victim navigate to a malicious website and guiding them through the OIDC flow, stealing the OAuth authorization code in the process. The authorization code then can be exchanged by the attacker for a token, gaining access to applications accepting that token.
### Steps to reproduce
1) A victim navigates to a malicious website
2) The webserver initiates a connection with a Dex instance directly - https://dexexample.com/auth/https:%252F%252Faccounts.google.com?access_type=online&clien
GHSA
Dex vulnerable to Man-in-the-Middle allowing ID token capture via intercepted authorization code
ghsa·2022-10-03
CVE-2022-39222 [CRITICAL] CWE-200 Dex vulnerable to Man-in-the-Middle allowing ID token capture via intercepted authorization code
Dex vulnerable to Man-in-the-Middle allowing ID token capture via intercepted authorization code
### Impact
Dex instances with public clients (and by extension, clients accepting tokens issued by those Dex instances) are affected by this vulnerability.
An attacker can exploit this vulnerability by making a victim navigate to a malicious website and guiding them through the OIDC flow, stealing the OAuth authorization code in the process. The authorization code then can be exchanged by the attacker for a token, gaining access to applications accepting that token.
### Steps to reproduce
1) A victim navigates to a malicious website
2) The webserver initiates a connection with a Dex instance directly - https://dexexample.com/auth/https:%252F%252Faccounts.google.com?access_type=online&clien
Red Hat
dexidp: gaining access to applications accepting that token
vendor_redhat·2022-10-06·CVSS 9.3
CVE-2022-39222 [CRITICAL] CWE-862 dexidp: gaining access to applications accepting that token
dexidp: gaining access to applications accepting that token
Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients accepting tokens issued by those Dex instances) are affected by this vulnerability if they are running a version prior to 2.35.0. An attacker can exploit this vulnerability by making a victim navigate to a malicious website and guiding them through the OIDC flow, stealing the OAuth authorization code in the process. The authorization code then can be exchanged by the attacker for a token, gaining access to applications accepting that token. Version 2.35.0 has introduced a fix for this issue. Users are advised to upgrade. There are no known workarounds for this issue.
A flaw was
No detection rules found.
No public exploits indexed.
2022-10-06
Published