CVE-2023-50714

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-50714
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the `authCodeVerifier` should be removed after usage (similar to `authState`). Second, there is a risk for a `downgrade attack` if PKCE is being relied on for CSRF protection. Version 2.2.15 contains a patch for the issue. No known workarounds are available.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth1.php#L158 Product
https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth2.php#L121 Product
https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OpenIdConnect.php#L420 Product
https://github.com/yiisoft/yii2-authclient/commit/721ed974bc44137437b0cdc8454e137fff8db213 Patch
https://github.com/yiisoft/yii2-authclient/security/advisories/GHSA-rw54-6826-c8j5 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:yiiframework:yii2-authclient:*:*:*:*:*:*:*:*
History

08 Jan 2024, 15:12

Type Values Removed Values Added
CPE cpe:2.3:a:yiiframework:yii2-authclient:*:*:*:*:*:*:*:*
Summary
  • (es) yii2-authclient es una extensión que agrega consumidores OpenID, OAuth, OAuth2 y OpenId Connect para el framework Yii 2.0. En yii2-authclient anterior a la versión 2.2.15, la implementación de Oauth2 PKCE es vulnerable de 2 maneras. Primero, "authCodeVerifier" debe eliminarse después de su uso (similar a "authState"). En segundo lugar, existe el riesgo de un "downgrade attack" si se confía en PKCE para la protección CSRF. La versión 2.2.15 contiene un parche para el problema. No hay workarounds disponibles.
CVSS v2 : unknown
v3 : 6.8 		v2 : unknown
v3 : 8.8
CWE CWE-287
References () https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth1.php#L158 - () https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth1.php#L158 - Product
References () https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth2.php#L121 - () https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth2.php#L121 - Product
References () https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OpenIdConnect.php#L420 - () https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OpenIdConnect.php#L420 - Product
References () https://github.com/yiisoft/yii2-authclient/commit/721ed974bc44137437b0cdc8454e137fff8db213 - () https://github.com/yiisoft/yii2-authclient/commit/721ed974bc44137437b0cdc8454e137fff8db213 - Patch
References () https://github.com/yiisoft/yii2-authclient/security/advisories/GHSA-rw54-6826-c8j5 - () https://github.com/yiisoft/yii2-authclient/security/advisories/GHSA-rw54-6826-c8j5 - Exploit, Third Party Advisory
First Time Yiiframework
Yiiframework yii2-authclient

22 Dec 2023, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-22 19:15

Updated : 2024-01-08 15:12

NVD link : CVE-2023-50714

Mitre link : CVE-2023-50714

CVE.ORG link : CVE-2023-50714

JSON object : View

Products Affected

yiiframework

  • yii2-authclient
CWE
CWE-287

Improper Authentication

CWE-347

Improper Verification of Cryptographic Signature

CWE-918

Server-Side Request Forgery (SSRF)