CVE-2023-34246 Doorkeeper Improper Authentication vulnerability
Doorkeeper library allows public clients to bypass user consent for previously approved authorization requests, enabling potential impersonation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-34246?
CVE-2023-34246 is a medium-severity authentication bypass vulnerability in doorkeeper-gem doorkeeper, published on 12 Jun 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.
Weakness: CWE-287
Which versions are affected by CVE-2023-34246?
2 open source packages ship an affected version, including doorkeeper. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
doorkeeper RubyGems | All versions | 5.6.6 |
doorkeeper RubyGems | All versions | 5.6.6 |
Products include Doorkeeper Project Doorkeeper.
How do I fix CVE-2023-34246?
Upgrade doorkeeper to 5.6.6 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-34246 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-34246 exists.
Other vulnerabilities in doorkeeper-gem doorkeeper
- CVE-2016-6582 Doorkeeper is vulnerable to replay attacks
- CVE-2020-10187 Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper
- CVE-2018-1000211 Doorkeeper subject to Incorrect Permission Assignment
- CVE-2014-8144 Doorkeeper vulnerable to Cross-site Request Forgery
- CVE-2018-1000088 Doorkeeper is vulnerable to stored XSS and code execution
Sources
Also known as DEBIAN-CVE-2023-34246, DLA-3494-1, DLA-3989-1, GHSA-7w2c-w47h-789w, UBUNTU-CVE-2023-34246, USN-6210-1.