CVE-2023-36820 micronaut security has invalid IdTokenClaimsValidator logic on aud
Attackers can bypass audience validation in Micronaut Security, allowing unauthorized access when multiple applications share an OIDC issuer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-36820?
CVE-2023-36820 is a medium-severity authentication bypass vulnerability in micronaut-projects micronaut-security, published on 9 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared. This issue has been patched in versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1.
Weakness: CWE-284
Which versions are affected by CVE-2023-36820?
22 open source packages ship an affected version, including io.micronaut.security:micronaut-security-oauth2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.1.0 | 3.1.2 |
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.1.0 | 3.1.2 |
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.10.0 | 3.10.2 |
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.10.0 | 3.10.2 |
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.11.0 | 3.11.1 |
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.11.0 | 3.11.1 |
16 more packages
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.2.0 | 3.2.4 |
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.2.0 | 3.2.4 |
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.3.0 | 3.3.2 |
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.3.0 | 3.3.2 |
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.4.0 | 3.4.3 |
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.4.0 | 3.4.3 |
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.5.0 | 3.5.3 |
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.5.0 | 3.5.3 |
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.6.0 | 3.6.6 |
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.6.0 | 3.6.6 |
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.7.0 | 3.7.4 |
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.7.0 | 3.7.4 |
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.8.0 | 3.8.4 |
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.8.0 | 3.8.4 |
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.9.0 | 3.9.6 |
io.micronaut.security:micronaut-security-oauth2 Maven | From 3.9.0 | 3.9.6 |
Products include Objectcomputing Micronaut Security.
How do I fix CVE-2023-36820?
Upgrade io.micronaut.security:micronaut-security-oauth2 to a fixed version for your release line: 3.1.2, 3.10.2, 3.11.1 or 3.2.4.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-36820 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-36820 exists.
Sources
Also known as GHSA-qw22-8w9r-864h.