# GHSA-9wgg-m99q-hhfc: Expired tokens can be renewed without validating the account password > Attackers can renew expired OAuth tokens without password validation, potentially taking over accounts if using the CCG flow without secret encryption. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Any signed-in user - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 19 Dec 2023 ## What is GHSA-9wgg-m99q-hhfc? GHSA-9wgg-m99q-hhfc is an authentication bypass vulnerability in emailproxy, published on 19 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim. ### Official description ### Impact In versions of the proxy from `2022-09-05` onwards (since 8c874c2ff3d503ac20c7d32f46e08547fcb9e23f), expired OAuth 2.0 client credentials grant (CCG) flow authorisation tokens could be renewed automatically without checking their validity against the original account configuration (i.e., the password that was set up when first creating an account in the proxy). An attacker with knowledge of valid account addresses and careful timing (specifically, attempting to log in during a period from 10 minutes prior to the token expiry time, but before a genuine login request is received) could use this issue to gain access to an account. This issue is only a security concern if you use the proxy with the CCG flow and no additional account secret encryption (see below). If this is the case, it is particularly important to update if you use the proxy in a publicly-accessible setting (i.e., it is available from the internet or across a network). To fix the issue you should switch to version [`2023-12-19`](https://github.com/simonrob/email-oauth2-proxy/releases/tag/2023-12-19) or later of the proxy immediately. If you use this flow, but have also set `encrypt_client_secret_on_first_use = True` *and* removed the original `client_secret` value from the proxy's configuration file then this issue is not a concern. For all other use-cases (e.g., a normal interactive account authentication, or the ROPCG flow), this issue is also not a concern. However, it is always recommended as best practice to keep the proxy up-to-date. ### Patches [Email OAuth 2.0 Proxy version `2023-12-19`](https://github.com/simonrob/email-oauth2-proxy/releases/tag/2023-12-19) (commit eaaa1a2e7a132bf0958dd2f99a749ad98e3212aa) fixes this issue. ### Issue details Because it was originally designed for use as an interactive, local-only service on a single device, the proxy automatically resets account access tokens if incorrect IMAP/POP/SMTP login details are provided. For public-facing deployments, the `delete_account_token_on_password_error` option is provided, and can be set to `False` to disable this behaviour, which would normally be only a nuisance, rather than a security risk. Regardless of this option's value, the proxy encrypts locally-stored tokens, and requires interactive re-authentication (or, with the resource owner password credentials grant (ROPCG) flow, the correct remote account password) to renew tokens if they expire or are reset. The proxy's token retrieval implementation was created with this interactive process in mind. The CCG flow is an administrator-level method that grants broad access without user knowledge or consent – no user interaction (or remote account password) is ever required. From 8c874c2ff3d503ac20c7d32f46e08547fcb9e23f until the fix in eaaa1a2e7a132bf0958dd2f99a749ad98e3212aa, when CCG tokens neared their expiry date (or had already expired), and the original unencrypted `client_secret` value was available they were automatically reset, renewed and encrypted with the given login password, but without checking whether that password was actually able to decrypt the _existing_ token. ### Detecting unauthorised access If you do not use the OAuth 2.0 CCG flow (which is currently only known to be supported by O365), unauthorised account access was not possible.[^1] Attempts to exploit this flaw will be revealed in the same way as any other malicious access: an unexpected reauthorisation prompt from the proxy when trying to log in with the legitimate account details. When using the CCG flow, if you have set `delete_account_token_on_password_error = False`, unauthorised access will be revealed by the presence of an unexpected login failure from the proxy when attempting to log in with the correct password. It you have not set this value, it is not possible to detect unauthorised access in O365 CCG mode except via AAD/Entra or other external logs. However, it is also worth reiterating that the CCG flow should never be used in a publicly-accessible context due to the significant and potentially dangerous account control it provides. [^1]: If you are using a provider that does not provide an OAuth 2.0 refresh token (or have configured your account's scope so that this is not present), it is possible to trigger the line of code that caused this issue, but there is no way to use it for account access because interactive authentication is still required. ## Which versions are affected by GHSA-9wgg-m99q-hhfc? 2 open source packages ship an affected version, including emailproxy. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `emailproxy` | PyPI | All versions | 2023.12.19 | | `emailproxy` | PyPI | All versions | 2023.12.19 | ## How do I fix GHSA-9wgg-m99q-hhfc? Upgrade emailproxy to 2023.12.19 or later. ## Is GHSA-9wgg-m99q-hhfc being exploited? There is no known exploitation of GHSA-9wgg-m99q-hhfc in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for GHSA-9wgg-m99q-hhfc and fix it if it is affected. What it is: GHSA-9wgg-m99q-hhfc is an authentication bypass vulnerability in emailproxy, published on 19 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim. Exploitation: There is no known exploitation of GHSA-9wgg-m99q-hhfc in the wild and no public exploit code. Affected packages and fixed versions: - emailproxy (PyPI): affected all versions; fixed in 2023.12.19 - emailproxy (PyPI): affected all versions; fixed in 2023.12.19 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/GHSA-9wgg-m99q-hhfc/ (Markdown: https://insights.sbomify.com/GHSA-9wgg-m99q-hhfc/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/GHSA-9wgg-m99q-hhfc --- From sbomify Insights: https://insights.sbomify.com/GHSA-9wgg-m99q-hhfc/ Summaries are generated and may contain mistakes; the official description above is the record.