CVE-2021-23365 Authentication Bypass
Attackers can bypass SAML authentication in Tyk Identity Broker due to XML parser integrity issues, allowing unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-23365?
CVE-2021-23365 is a medium-severity authentication bypass vulnerability in github.com/TykTechnologies/tyk-identity-broker, published on 26 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip (encoding/decoding XML data).
Weakness: CWE-287
Which versions are affected by CVE-2021-23365?
3 open source packages ship an affected version, including github.com/tyktechnologies/tyk-identity-broker and github.com/TykTechnologies/tyk-identity-broker. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/tyktechnologies/tyk-identity-broker Go | All versions | 1.1.1 |
github.com/tyktechnologies/tyk-identity-broker Go | All versions | 1.1.1 |
github.com/TykTechnologies/tyk-identity-broker Go | All versions | 1.1.1 |
Products include Tyk Tyk-Identity-Broker.
How do I fix CVE-2021-23365?
Upgrade github.com/tyktechnologies/tyk-identity-broker to 1.1.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-23365 being exploited?
There is no known exploitation of CVE-2021-23365 in the wild and no public exploit code.
Sources
Also known as GHSA-599h-8wpj-75xj, GO-2022-0906, SNYK-GOLANG-GITHUBCOMTYKTECHNOLOGIESTYKIDENTITYBROKER-1089720.