CVE-2020-5300: Authentication Bypass in hydra
Summary
CVE-2020-5300: Authentication Bypass in hydra. Affects github.com/ory/hydra versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is 'github.com/ory/hydra', which is written in Go. Hydra is an OpenID Connect and OAuth 2.0 server that provides authentication and authorization services. It allows clients to obtain access tokens and authenticate users. The vulnerability in question affects the 'private_key_jwt' client authentication method used in Hydra. This method is specified in the OpenID Connect Core 1.0 specification. The vulnerability allows an attacker to bypass authentication and obtain multiple access tokens using the same 'jti' assertion, which is supposed to be unique and prevent token reuse.
Vulnerability Detail
The impact of this vulnerability is that an attacker can send the same token request multiple times, each time with the same 'jti' assertion, and obtain multiple access tokens. This bypasses the intended uniqueness check of the 'jti' value. Although the severity of this vulnerability is rated as medium, there are mitigating factors that make it difficult to exploit. These factors include the protection provided by TLS against MITM attacks and the short expiry time of the JWTs. The vulnerability will be patched in version 1.4.0+oryOS.17 of the 'github.com/ory/hydra' package.
How To Fix
Minimum fixed version
1.4.0
This is the first release that contains the fix.
go get github.com/ory/hydra@v1.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Two workarounds have been identified:
- Do not allow clients to use the 'private_key_jwt' authentication method.
- Use short expiry times for the JWTs.
Conclusion
In conclusion, the 'github.com/ory/hydra' package is vulnerable to an authentication bypass issue in the 'private_key_jwt' client authentication method. This vulnerability allows an attacker to obtain multiple access tokens by bypassing the uniqueness check of the 'jti' value. The recommended fix is to update to version 1.4.0+oryOS.17 or later of the package. Two workarounds are also available: disallowing the use of 'private_key_jwt' authentication method and using short expiry times for the JWTs. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/ory/hydra →
FAQ
The impact is that an attacker can bypass authentication and obtain multiple access tokens using the same 'jti' assertion.
You can fix this vulnerability by updating to version 1.4.0+oryOS.17 or later of the 'github.com/ory/hydra' package.
Yes, two workarounds have been identified: 1) Disallow clients from using the 'private_key_jwt' authentication method, and 2) Use short expiry times for the JWTs.
The severity is rated as medium due to mitigating factors such as TLS protection and short expiry times of the JWTs.
You can find more information about the OpenID Connect specification at https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ory/hydra.
