CVE-2021-22573: Vulnerability in com.google.oauth-client:google-oauth-client
Summary
CVE-2021-22573: google-oauth-java-client improperly verifies cryptographic signature. Affects com.google.oauth-client:google-oauth-client versions >= 1.16.0-rc, < 1.33.3. Fixed in 1.33.3. How to fix ↓
Also tracked for
- google-oauth-client-java · Debian:11
The same CVE-2021-22573 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.google.oauth-client:google-oauth-client package is an open-source library that provides functionality for handling OAuth authentication with Google APIs. It includes classes for verifying ID tokens, which are used for authentication and authorization. This vulnerability specifically affects the IdTokenVerifier class within the library.
Vulnerability Detail
The vulnerability in com.google.oauth-client:google-oauth-client arises from the improper verification of cryptographic signatures in the IdTokenVerifier class. The verify method in this class does not validate the signature before verifying the claims of the token. This allows an attacker to provide a compromised token with a modified payload, such as an email or phone number. The library will pass the validation and the modified payload can be used by the application. While the risk is low if the verified IdToken is only used within the application, there is a potential risk if the token is sent to another service without further signature verification.
How To Fix
Minimum fixed version
1.33.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the library is not possible, alternative IdToken verifiers provided by Google can be used, such as the ones available in the google-auth-library-java and google-api-java-client packages. These verifiers already have signature verification implemented.
Conclusion
The com.google.oauth-client:google-oauth-client library has a vulnerability that allows for the improper verification of cryptographic signatures in the IdTokenVerifier class. This can lead to unauthorized access or other security issues if compromised tokens with modified payloads are used. It is recommended to update to version 1.33.3 or higher of the library to fix this vulnerability. Alternatively, you can use alternative IdToken verifiers provided by Google. For more information and assistance, please contact DevNack.com.
See every vulnerability recorded for com.google.oauth-client:google-oauth-client →
FAQ
The impact of this vulnerability is that an attacker can provide a compromised token with a modified payload, which may lead to unauthorized access or other security issues depending on how the token is used.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file and the playground will analyze it for open-source vulnerabilities in real-time.
If you are unable to update the library directly, you can consider using alternative IdToken verifiers provided by Google, such as the ones available in the google-auth-library-java and google-api-java-client packages.
The CVSS score of this vulnerability is 7.3, indicating a high severity.
For more information, you can refer to the GitHub advisory at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-hw42-3568-wj87/GHSA-hw42-3568-wj87.json or reach out to info@devnack.com for further support on vulnerability remediation.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.google.oauth-client:google-oauth-client.
