GHSA-f28g-86hc-823q Tokenizer vulnerable to client brute-force of token secrets
Authorized clients can brute-force token secrets via the Proxy-Tokenizer header, potentially bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-f28g-86hc-823q?
GHSA-f28g-86hc-823q is a vulnerability in github.com/superfly/tokenizer, published on 13 Jul 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Impact
Authorized clients, having an inject_processor secret, could brute-force the secret token value by abusing the fmt parameter to the Proxy-Tokenizer header.
Patches
This was fixed in https://github.com/superfly/tokenizer/pull/8 and further mitigated in https://github.com/superfly/tokenizer/pull/9.
Which versions are affected by GHSA-f28g-86hc-823q?
3 open source packages ship an affected version, including github.com/superfly/tokenizer.
| Package | Affected | Fixed in |
|---|---|---|
github.com/superfly/tokenizer Go | All versions | 0.0.1 |
github.com/superfly/tokenizer Go | All versions | 0.0.1 |
github.com/superfly/tokenizer Go | All versions | 0.0.1 |
How do I fix GHSA-f28g-86hc-823q?
Upgrade github.com/superfly/tokenizer to 0.0.1 or later.
Is GHSA-f28g-86hc-823q being exploited?
There is no known exploitation of GHSA-f28g-86hc-823q in the wild and no public exploit code.
Sources
Also known as GO-2023-1914.