CVE-2020-7692: Improper Authorization in Google OAuth Client
Summary
CVE-2020-7692: Improper Authorization in Google OAuth Client. Affects com.google.oauth-client:google-oauth-client versions < 1.31.0. Fixed in 1.31.0. How to fix ↓
Also tracked for
- google-oauth-client-java · Debian:11
The same CVE-2020-7692 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.google.oauth-client:google-oauth-client package is a Maven package that provides functionality for implementing Google OAuth client applications. It allows developers to integrate Google OAuth authentication and authorization into their applications, enabling users to securely access Google APIs and services. However, a vulnerability has been identified in versions prior to 1.31.0 that could lead to improper authorization.
Vulnerability Detail
The vulnerability arises from the lack of implementation of PKCE (Proof Key for Code Exchange) support in accordance with the RFC for OAuth 2.0 for Native Apps. Without PKCE, the authorization code returned by an authorization server is not sufficient to ensure that the client that initiated the authorization request is the one being authorized. This opens up the possibility for an attacker to obtain the authorization code using a malicious app on the client-side and exploit it to gain unauthorized access to protected resources. The affected package is com.google.oauth-client:google-oauth-client before version 1.31.0.
How To Fix
Minimum fixed version
1.31.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the package to the fixed version to address the issue effectively.
Conclusion
The com.google.oauth-client:google-oauth-client package before version 1.31.0 is vulnerable to improper authorization due to the lack of PKCE support. To mitigate this vulnerability, it is crucial to update the package to version 1.31.0 or later. For additional assistance and guidance, please contact DevNack.com.
See every vulnerability recorded for com.google.oauth-client:google-oauth-client →
FAQ
com.google.oauth-client:google-oauth-client is a Maven package that enables developers to integrate Google OAuth authentication and authorization into their applications.
PKCE stands for Proof Key for Code Exchange. It is a security enhancement for OAuth 2.0 authorization flows, specifically designed for native apps.
The vulnerability could allow an attacker to obtain unauthorized access to protected resources by exploiting the improper authorization process.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
For further support on vulnerability remediation, you can reach out to info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.google.oauth-client:google-oauth-client.
