GHSA-mjcr-rqjg-rhg3 Implementation trusts the "me" field returned by the authorization server without verifying it
Attackers can impersonate any user by exploiting unverified IndieAuth identifiers, allowing unauthorized account access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-mjcr-rqjg-rhg3?
GHSA-mjcr-rqjg-rhg3 is an authentication bypass vulnerability in datasette-indieauth, published on 24 Nov 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Impact
A malicious user can sign in as a user with any IndieAuth identifier. This is because the implementation does not verify that the final "me" URL value returned by the authorization server belongs to the same domain as the initial value entered by the user.
Patches
Version 1.1 fixes this issue.
Workarounds
There is no workaround. Upgrade to 1.1 immediately.
References
- Security Considerations: Differing User Profile URLs in the IndieAuth specification.
For more information
If you have any questions or comments about this advisory:
- Open an issue in simonw/datasette-indieauth
Which versions are affected by GHSA-mjcr-rqjg-rhg3?
2 open source packages ship an affected version, including datasette-indieauth.
| Package | Affected | Fixed in |
|---|---|---|
datasette-indieauth PyPI | From 1.0 | 1.1 |
datasette-indieauth PyPI | From 1.0 | 1.1 |
How do I fix GHSA-mjcr-rqjg-rhg3?
Upgrade datasette-indieauth to 1.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is GHSA-mjcr-rqjg-rhg3 being exploited?
There is no known exploitation of GHSA-mjcr-rqjg-rhg3 in the wild and no public exploit code.