GHSA-hhw9-35p2-q2c5 Steam Socialite Provider v1 does not correctly validate openid server
Attackers can bypass Steam login validation by substituting a malicious OpenID server, potentially taking over user accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-hhw9-35p2-q2c5?
GHSA-hhw9-35p2-q2c5 is an authentication bypass vulnerability in socialiteproviders/steam, published on 29 Jan 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Impact
The outdated version 1 of the Steam Socialite Provider doesn't check properly if the login comes from steamcommunity.com, allowing a malicious actor to substitute their own openID server.
Patches
This vulnerability only affects the outdated v1.x versions of the package. These are no longer maintained, users should upgrade to v3 or v4, which use a hardcoded endpoint to verify the login.
For more information
If you have any questions or comments about this advisory:
- Open an issue in SocialiteProviders/Providers
- Email us at [email protected]
Which versions are affected by GHSA-hhw9-35p2-q2c5?
2 open source packages ship an affected version, including socialiteproviders/steam.
| Package | Affected | Fixed in |
|---|---|---|
socialiteproviders/steam Packagist | All versions | 3.0 |
socialiteproviders/steam Packagist | All versions | 3.0 |
How do I fix GHSA-hhw9-35p2-q2c5?
Upgrade socialiteproviders/steam to 3.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is GHSA-hhw9-35p2-q2c5 being exploited?
There is no known exploitation of GHSA-hhw9-35p2-q2c5 in the wild and no public exploit code.