CVE-2021-32701
Possible bypass of token claim validation when OAuth2 Introspection caching is enabled
En resumen
Cuando el almacenamiento en caché de tokens OAuth2 está habilitado en ORY Oathkeeper, el sistema no verifica si un token en caché tiene los permisos correctos para una nueva solicitud, permitiendo que alguien acceda a endpoints que no debería si su token fue validado recientemente para un endpoint diferente.
Detalle técnico
La validación de caché del autenticador oauth2_introspection omite la verificación de alcances, validando solo la expiración del token. Un atacante con un token válido para el alcance 'foo' puede acceder a endpoints que requieren el alcance 'bar' si el token permanece en caché antes de la expiración, eludiendo las comprobaciones de autorización que deberían fallar. Afecta versiones de ORY Oathkeeper anteriores a v0.38.12-beta.1 cuando el caché de introspection está explícitamente habilitado.
Resumen generado y traducido por IA a partir de la descripción oficial.
ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. When you make a request to an endpoint that requires the scope `foo` using an access token granted with that `foo` scope, introspection will be valid and that token will be cached. The problem comes when a second requests to an endpoint that requires the scope `bar` is made before the cache has expired. Whether the token is granted or not to the `bar` scope, introspection will be valid. A patch will be released with `v0.38.12-beta.1`. Per default, caching is disabled for the `oauth2_introspection` authenticator. When caching is disabled, this vulnerability does not exist. The cache is checked in [`func (a *AuthenticatorOAuth2Introspection) Authenticate(...)`](https://github.com/ory/oathkeeper/blob/6a31df1c3779425e05db1c2a381166b087cb29a4/pipeline/authn/authenticator_oauth2_introspection.go#L152). From [`tokenFromCache()`](https://github.com/ory/oathkeeper/blob/6a31df1c3779425e05db1c2a381166b087cb29a4/pipeline/authn/authenticator_oauth2_introspection.go#L97) it seems that it only validates the token expiration date, but ignores whether the token has or not the proper scopes. The vulnerability was introduced in PR #424. During review, we failed to require appropriate test coverage by the submitter which is the primary reason that the vulnerability passed the review process.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N