CVE-2023-46241

{"id": "CVE-2023-46241", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.2}]}, "published": "2024-02-21T16:15:49.240", "references": [{"url": "https://github.com/discourse/discourse-microsoft-auth/commit/c40665f44509724b64938c85def9fb2e79f62ec8", "source": "security-advisories@github.com"}, {"url": "https://github.com/discourse/discourse-microsoft-auth/security/advisories/GHSA-2w32-w539-3m7r", "source": "security-advisories@github.com"}, {"url": "https://learn.microsoft.com/en-us/security/zero-trust/develop/identity-supported-account-types", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "`discourse-microsoft-auth` is a plugin that enables authentication via Microsoft. On sites with the `discourse-microsoft-auth` plugin enabled, an attack can potentially take control of a victim's Discourse account. Sites that have configured their application's account type to any options other than `Accounts in this organizational directory only (O365 only - Single tenant)` are vulnerable. This vulnerability has been patched in commit c40665f44509724b64938c85def9fb2e79f62ec8 of `discourse-microsoft-auth`. A `microsoft_auth:revoke` rake task has also been added which will deactivate and log out all users that have connected their accounts to Microsoft. User API keys as well as API keys created by those users will also be revoked. The rake task will also remove the connection records to Microsoft for those users. This will allow affected users to re-verify their account emails as well as reconnect their Discourse account to Microsoft for authentication. As a workaround, disable the `discourse-microsoft-auth` plugin by setting the `microsoft_auth_enabled` site setting to `false`. Run the `microsoft_auth:log_out_users` rake task to log out all users with associated Microsoft accounts.\n"}, {"lang": "es", "value": "`discourse-microsoft-auth` es un complemento que permite la autenticaci\u00f3n a trav\u00e9s de Microsoft. En sitios con el complemento `discourse-microsoft-auth` habilitado, un ataque puede potencialmente tomar el control de la cuenta de Discourse de una v\u00edctima. Los sitios que han configurado el tipo de cuenta de su aplicaci\u00f3n con cualquier opci\u00f3n distinta a \"Cuentas solo en este directorio organizacional (solo O365 - Inquilino \u00fanico)\" son vulnerables. Esta vulnerabilidad ha sido parcheada en el commit c40665f44509724b64938c85def9fb2e79f62ec8 de `discourse-microsoft-auth`. Tambi\u00e9n se agreg\u00f3 una tarea de rake `microsoft_auth:revoke` que desactivar\u00e1 y cerrar\u00e1 sesi\u00f3n a todos los usuarios que hayan conectado sus cuentas a Microsoft. Tambi\u00e9n se revocar\u00e1n las claves API de usuario, as\u00ed como las claves API creadas por esos usuarios. La tarea de rake tambi\u00e9n eliminar\u00e1 los registros de conexi\u00f3n a Microsoft para esos usuarios. Esto permitir\u00e1 a los usuarios afectados volver a verificar los correos electr\u00f3nicos de sus cuentas y volver a conectar su cuenta de Discourse a Microsoft para su autenticaci\u00f3n. Como workaround, deshabilite el complemento `discourse-microsoft-auth` estableciendo la configuraci\u00f3n del sitio `microsoft_auth_enabled` en `false`. Ejecute la tarea de rake `microsoft_auth:log_out_users` para cerrar la sesi\u00f3n de todos los usuarios con cuentas de Microsoft asociadas."}], "lastModified": "2024-02-22T19:07:27.197", "sourceIdentifier": "security-advisories@github.com"}