CVE-2020-15223highCWE-755

CVE-2020-15223: high-severity vulnerability in ory fosite

Ignored storage errors on token revokation in ORY Fosite

Published · Updated

Follow this CVE+ Monitor fosite+ Monitor github.com/ory/fosite

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8epss 1.6%
In short

A security flaw in ORY Fosite's token revocation feature causes it to report success (HTTP 200) even when the token wasn't actually revoked from storage due to an error. This means attackers could exploit storage failures to keep using tokens that should have been invalidated.

Technical detail

The TokenRevocationHandler fails to properly handle storage errors during token revocation, returning success status codes regardless of whether the revocation persisted to the backend. An attacker who can trigger storage failures may maintain access with revoked tokens; exploitation depends on ability to induce storage layer errors. Fixed in version 0.34.0.

Summary generated and translated by AI from the official description.
In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can use this for her advantage depends on the ability to trigger errors in the store. This is fixed in version 0.34.0
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected products
ory · fosite
Related CVEs — ory fosite

In the same product, most dangerous first.

CVE-2020-15222HIGHReplay of private_key_jwt possible in ORY FositeEPSS 0.9%CVE-2020-15234MEDIUMRedirect URL matching ignores character casingEPSS 0.8%CVE-2020-15233MEDIUMOAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addressesEPSS 0.8%