FKIE_CVE-2020-5300

Vulnerability from fkie_nvd - Published: 2020-04-06 17:15 - Updated: 2024-11-21 05:33
Severity ?
5.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method 'private_key_jwt' [1], OpenId specification says the following about assertion `jti`: "A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties". Hydra does not check the uniqueness of this `jti` value. Exploiting this vulnerability is somewhat difficult because: - TLS protects against MITM which makes it difficult to intercept valid tokens for replay attacks - The expiry time of the JWT gives only a short window of opportunity where it could be replayed This has been patched in version v1.4.0+oryOS.17
References
security-advisories@github.comhttps://github.com/ory/hydra/commit/700d17d3b7d507de1b1d459a7261d6fb2571ebe3Patch, Third Party Advisory
security-advisories@github.comhttps://github.com/ory/hydra/releases/tag/v1.4.0Third Party Advisory
security-advisories@github.comhttps://github.com/ory/hydra/security/advisories/GHSA-3p3g-vpw6-4w66Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/ory/hydra/commit/700d17d3b7d507de1b1d459a7261d6fb2571ebe3Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/ory/hydra/releases/tag/v1.4.0Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/ory/hydra/security/advisories/GHSA-3p3g-vpw6-4w66Third Party Advisory
Impacted products
Vendor Product Version
ory hydra *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ory:hydra:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DC62652F-A912-4B11-BACD-59690369C4E5",
              "versionEndExcluding": "1.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Hydra (an OAuth2 Server and OpenID Certified\u2122 OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method \u0027private_key_jwt\u0027 [1], OpenId specification says the following about assertion `jti`: \"A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties\". Hydra does not check the uniqueness of this `jti` value. Exploiting this vulnerability is somewhat difficult because: - TLS protects against MITM which makes it difficult to intercept valid tokens for replay attacks - The expiry time of the JWT gives only a short window of opportunity where it could be replayed This has been patched in version v1.4.0+oryOS.17"
    },
    {
      "lang": "es",
      "value": "En Hydra (un OAuth2 Server y OpenID Certified\u2122 OpenID Connect Provider escrito en Go), versiones anteriores a 1.4.0+oryOS.17, cuando se usa el m\u00e9todo de autenticaci\u00f3n del cliente `private_key_jwt` [1], la especificaci\u00f3n OpenId dice lo siguiente sobre la afirmaci\u00f3n `jti`: \"Un identificador \u00fanico para el token, que puede ser usado para impedir la reutilizaci\u00f3n del token. Estos tokens DEBEN solo ser usados una vez, a menos que las condiciones de reutilizaci\u00f3n sean negociadas entre las partes\". Hydra no comprueba la exclusividad de este valor de \u0027jti\u0027. Una explotaci\u00f3n de esta vulnerabilidad es algo dif\u00edcil porque: - TLS protege contra ataques de tipo MITM, lo que hace que sea dif\u00edcil interceptar tokens v\u00e1lidos para ataques de repetici\u00f3n - El tiempo de expiraci\u00f3n del JWT ofrece solo una peque\u00f1a ventana oportunidad para que pueda reproducirse Esto ha sido parcheado en la versi\u00f3n v1 .4.0+oryOS.17"
    }
  ],
  "id": "CVE-2020-5300",
  "lastModified": "2024-11-21T05:33:51.920",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.3,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-04-06T17:15:13.367",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/ory/hydra/commit/700d17d3b7d507de1b1d459a7261d6fb2571ebe3"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/ory/hydra/releases/tag/v1.4.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/ory/hydra/security/advisories/GHSA-3p3g-vpw6-4w66"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/ory/hydra/commit/700d17d3b7d507de1b1d459a7261d6fb2571ebe3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/ory/hydra/releases/tag/v1.4.0"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/ory/hydra/security/advisories/GHSA-3p3g-vpw6-4w66"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-294"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-294"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.