GHSA-MJCR-RQJG-RHG3严重已审查

Implementation trusts the "me" field returned by the authorization server without verifying it

OSV 1.4.0 · github-reviewed · 修改于 2022-03-22 04:04

发布时间

2020-11-25 05:21

GitHub 审查时间

2020-11-25 05:20

NVD 发布时间

—

源文件

advisories/github-reviewed/2020/11/GHSA-mjcr-rqjg-rhg3/GHSA-mjcr-rqjg-rhg3.json

公告说明

Impact

A malicious user can sign in as a user with any IndieAuth identifier. This is because the implementation does not verify that the final "me" URL value returned by the authorization server belongs to the same domain as the initial value entered by the user.

Patches

Version 1.1 fixes this issue.

Workarounds

There is no workaround. Upgrade to 1.1 immediately.

References

Security Considerations: Differing User Profile URLs in the IndieAuth specification.

For more information

If you have any questions or comments about this advisory:

Open an issue in simonw/datasette-indieauth

受影响的软件包

PyPI

datasette-indieauth

标识信息

别名 / CVE

无

CWE

CWE-290

软件生态

PyPI

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-mjcr-rqjg-rhg3",
  "aliases": [],
  "details": "### Impact\n\nA malicious user can sign in as a user with any IndieAuth identifier. This is because the implementation does not verify that the final `\"me\"` URL value returned by the authorization server belongs to the same domain as the initial value entered by the user.\n\n### Patches\n\nVersion 1.1 fixes this issue.\n\n### Workarounds\n\nThere is no workaround. Upgrade to 1.1 immediately.\n\n### References\n\n- [Security Considerations: Differing User Profile URLs](https://indieauth.spec.indieweb.org/#differing-user-profile-urls-li-1) in the IndieAuth specification.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [simonw/datasette-indieauth](https://github.com/simonw/datasette-indieauth/issues)",
  "summary": "Implementation trusts the \"me\" field returned by the authorization server without verifying it",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "1.0"
            },
            {
              "fixed": "1.1"
            }
          ]
        }
      ],
      "package": {
        "name": "datasette-indieauth",
        "ecosystem": "PyPI"
      },
      "versions": [
        "1.0"
      ]
    }
  ],
  "modified": "2022-03-21T20:04:49Z",
  "severity": [],
  "published": "2020-11-24T21:21:04Z",
  "references": [
    {
      "url": "https://github.com/simonw/datasette-indieauth/security/advisories/GHSA-mjcr-rqjg-rhg3",
      "type": "WEB"
    },
    {
      "url": "https://github.com/simonw/datasette-indieauth/commit/376c8804c6b0811852049229a24336fe5eb6a439",
      "type": "WEB"
    },
    {
      "url": "https://github.com/simonw/datasette-indieauth",
      "type": "PACKAGE"
    },
    {
      "url": "https://pypi.org/project/datasette-indieauth",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-290"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2020-11-24T21:20:38Z"
  }
}