GHSA-VH4H-FVQF-Q9WV中危已审查已撤回

Duplicate Advisory: @cloudflare/workers-oauth-provider PKCE bypass via downgrade attack

OSV 1.4.0 · github-reviewed · 修改于 2025-05-02 01:01

发布时间

2025-05-01 11:31

GitHub 审查时间

2025-05-02 01:01

NVD 发布时间

2025-05-01 09:15

源文件

advisories/github-reviewed/2025/05/GHSA-vh4h-fvqf-q9wv/GHSA-vh4h-fvqf-q9wv.json

该公告已于 2025-05-02 01:01 撤回

内容仅用于保留外部引用，请不要将其当作仍然有效的安全结论。

公告说明

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-qgp8-v765-qxx9. This link is maintained to preserve external references.

Original Description

PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped.

Fixed in:

https://github.com/cloudflare/workers-oauth-provider/pull/27 https://github.com/cloudflare/workers-oauth-provider/pull/27

Impact:

PKCE is a defense-in-depth mechanism against certain kinds of attacks and was an optional extension in OAuth 2.0 which became required in the OAuth 2.1 draft. (Note that the MCP specification requires OAuth 2.1.). This bug completely bypasses PKCE protection.

受影响的软件包

npm

标识信息

别名 / CVE

无

CWE

CWE-287

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V4

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

原始 OSV JSON

{
  "id": "GHSA-vh4h-fvqf-q9wv",
  "aliases": [],
  "details": "# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-qgp8-v765-qxx9. This link is maintained to preserve external references.\n\n# Original Description\nPKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of  MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped.\n\n\nFixed in:\n\n \n\n https://github.com/cloudflare/workers-oauth-provider/pull/27 https://github.com/cloudflare/workers-oauth-provider/pull/27 \n\n\nImpact: \n\nPKCE is a defense-in-depth mechanism against certain kinds of attacks and was an optional extension in OAuth 2.0 which became required in the OAuth 2.1 draft. (Note that the MCP specification requires OAuth 2.1.). This bug completely bypasses PKCE protection.",
  "summary": "Duplicate Advisory: @cloudflare/workers-oauth-provider PKCE bypass via downgrade attack",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.5"
            }
          ]
        }
      ],
      "package": {
        "name": "@cloudflare/workers-oauth-provider",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2025-05-01T17:01:34Z",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber"
    }
  ],
  "published": "2025-05-01T03:31:17Z",
  "withdrawn": "2025-05-01T17:01:33Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4144",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/cloudflare/workers-oauth-provider/pull/27",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2025-05-01T01:15:54Z",
    "github_reviewed_at": "2025-05-01T17:01:33Z"
  }
}