CVE-2023-32312 Client secret not mandatory in UmbracoIdentityExtensions
Attackers can access protected endpoints without authentication because client secrets are not enforced in the UmbracoIdentityExtensions package.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-32312?
CVE-2023-32312 is a low-severity authentication bypass vulnerability in UmbracoIdentityExtensions, published on 9 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected versions client secrets are not required which may expose some endpoints to untrusted actors. Since Umbraco is not a single-page application, the implicit flow is not safe. For traditional MVC applications, it is recommended to use the authorization code flow, which requires the client to authenticate with the authorization server using a client secret. This flow provides better security, as it involves exchanging an authorization code for an access token and/or ID token, rather than directly returning tokens in the URL fragment. This issue has been patched in commit `e792429f9` and a release to Nuget is pending. Users are advised to upgrade when possible.
Weakness: CWE-200
Which versions are affected by CVE-2023-32312?
It affects 1 product.
Products include Umbraco Umbraco Identity Extensibility.
How do I fix CVE-2023-32312?
No fix has been published for CVE-2023-32312 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-32312 being exploited?
There is no known exploitation of CVE-2023-32312 in the wild and no public exploit code.
Sources
Also known as GHSA-f2rf-8mwf-6jfh.