CVE-2020-15223 Ignored storage errors on token revokation in ORY Fosite
Attackers may retain valid tokens after revocation attempts if storage errors occur, bypassing security controls in ORY Fosite.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-15223?
CVE-2020-15223 is a high-severity vulnerability in ory fosite, published on 24 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can use this for her advantage depends on the ability to trigger errors in the store. This is fixed in version 0.34.0
Which versions are affected by CVE-2020-15223?
3 open source packages ship an affected version, including github.com/ory/fosite. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/ory/fosite Go | All versions | 0.34.0 |
github.com/ory/fosite Go | All versions | 0.34.0 |
github.com/ory/fosite Go | All versions | 0.34.0 |
Products include Ory Fosite.
How do I fix CVE-2020-15223?
Upgrade github.com/ory/fosite to 0.34.0 or later.
Is CVE-2020-15223 being exploited?
There is no known exploitation of CVE-2020-15223 in the wild and no public exploit code.
Other vulnerabilities in ory fosite
Sources
Also known as GHSA-7mqr-2v3q-v2wm, GO-2021-0109.