CVE-2023-34246
published 2023-06-12CVE-2023-34246: Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user…
PriorityP335medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
0.72%
49.6th percentile
Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ruby-doorkeeper | < ruby-doorkeeper 5.5.0-2+deb12u1 (bookworm) | ruby-doorkeeper 5.5.0-2+deb12u1 (bookworm) |
| doorkeeper-gem | doorkeeper | < 5.6.6 | 5.6.6 |
| doorkeeper_project | doorkeeper | < 5.6.6 | 5.6.6 |
| doorkeeper_project | doorkeeper | >= 0 < 5.6.6 | 5.6.6 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
osv6.5MEDIUM
vendor_debian4.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Doorkeeper Improper Authentication vulnerability
ghsa·2023-06-12
CVE-2023-34246 [MEDIUM] CWE-287 Doorkeeper Improper Authentication vulnerability
Doorkeeper Improper Authentication vulnerability
OAuth RFC 8252 says https://www.rfc-editor.org/rfc/rfc8252#section-8.6
> the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. **This includes the case where the user has previously approved an authorization request for a given client id**
But Doorkeeper automatically processes authorization requests without user consent for public clients that have been previously approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.
Issue https://github.com/doorkeeper-gem/doorkeeper/issues/1589
Fix https://github.com/doorkeeper-gem/doorkeeper/pull/1646
OSV
CVE-2023-34246: Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape
osv·2023-06-12·CVSS 6.5
CVE-2023-34246 [MEDIUM] CVE-2023-34246: Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape
Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.
OSV
Doorkeeper Improper Authentication vulnerability
osv·2023-06-12
CVE-2023-34246 [MEDIUM] Doorkeeper Improper Authentication vulnerability
Doorkeeper Improper Authentication vulnerability
OAuth RFC 8252 says https://www.rfc-editor.org/rfc/rfc8252#section-8.6
> the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. **This includes the case where the user has previously approved an authorization request for a given client id**
But Doorkeeper automatically processes authorization requests without user consent for public clients that have been previously approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.
Issue https://github.com/doorkeeper-gem/doorkeeper/issues/1589
Fix https://github.com/doorkeeper-gem/doorkeeper/pull/1646
Ubuntu
Doorkeeper vulnerability
vendor_ubuntu·2023-07-07
CVE-2023-34246 Doorkeeper vulnerability
Title: Doorkeeper vulnerability
Summary: Doorkeeper could be made to expose sensitive information over the
network.
It was discovered that Doorkeeper incorrectly performed authorization checks
for public clients that have been previous approved. An attacker could
potentially exploit these in order to impersonate another user and obtain
sensitive information.
Instructions: After a standard system update you need to restart any applications using
Doorkeeper to make all the necessary changes.
Debian
CVE-2023-34246: ruby-doorkeeper - Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5....
vendor_debian·2023·CVSS 4.2
CVE-2023-34246 [MEDIUM] CVE-2023-34246: ruby-doorkeeper - Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5....
Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.
Scope: local
bookworm: resolved (fixed in 5.5.0-2+deb12u1)
bullseye: resolved (fixed in 5.3.0-2+deb11u1)
forky: resolved (fixed in 5.6.6-2)
sid: resolved (fixed in 5.6.6-2)
trixie: resolved (fixed in 5.6.6-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/doorkeeper-gem/doorkeeper/issues/1589https://github.com/doorkeeper-gem/doorkeeper/pull/1646https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v5.6.6https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-7w2c-w47h-789whttps://lists.debian.org/debian-lts-announce/2023/07/msg00016.htmlhttps://www.rfc-editor.org/rfc/rfc8252#section-8.6https://github.com/doorkeeper-gem/doorkeeper/issues/1589https://github.com/doorkeeper-gem/doorkeeper/pull/1646https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v5.6.6https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-7w2c-w47h-789whttps://lists.debian.org/debian-lts-announce/2023/07/msg00016.htmlhttps://lists.debian.org/debian-lts-announce/2024/12/msg00010.htmlhttps://www.rfc-editor.org/rfc/rfc8252#section-8.6
2023-06-12
Published