CVE-2021-41580: Improper Access Control in passport-oauth2
Summary
CVE-2021-41580: Improper Access Control in passport-oauth2. Affects passport-oauth2 versions < 1.6.1. Fixed in 1.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The passport-oauth2 package is a popular npm package used in Node.js applications for implementing OAuth 2.0 authentication. It provides a simple and convenient way to integrate OAuth 2.0 identity providers into applications. The package allows users to authenticate with various OAuth providers and obtain access tokens for authorization. However, prior to version 1.6.1, the package had an improper access control vulnerability that could be exploited in certain scenarios.
Vulnerability Detail
The vulnerability in passport-oauth2 arises from a mishandling of the error condition when failing to obtain an access token. In some cases, OAuth identity providers use an HTTP 200 status code to indicate authentication failure. However, the passport-oauth2 package does not properly handle this error condition. As a result, an application using this package may grant authorization based solely on the receipt of an access token, without verifying its validity. This can lead to unauthorized access and potential security breaches. It's important to note that the passport-oauth2 vendor does not consider this vulnerability a passport-oauth2 issue.
How To Fix
Minimum fixed version
1.6.1
This is the first release that contains the fix.
npm install passport-oauth2@1.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can mitigate the risk by manually verifying the validity of the access token before granting authorization. This can be done by making a request to the OAuth identity provider's token validation endpoint and checking the response for a valid authentication status.
Conclusion
The improper access control vulnerability in the passport-oauth2 package can lead to unauthorized access and potential security breaches. It is crucial for developers to update to version 1.6.1 or later to fix this vulnerability. Additionally, manual verification of access tokens can help mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for passport-oauth2 →
FAQ
The vulnerability can potentially allow unauthorized access to protected resources in an application that uses the passport-oauth2 package. This can lead to data breaches, privilege escalation, and other security issues.
Versions prior to 1.6.1 of the passport-oauth2 package are affected by this vulnerability.
There is no known exploit for this vulnerability at the moment. However, it is recommended to update to the latest version of the package to mitigate the risk.
There are alternative OAuth 2.0 packages available for Node.js, such as passport-oauth and oauth2orize. Developers can consider using these packages as alternatives to passport-oauth2.
For more information about this vulnerability, you can refer to the GitHub advisory database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-f794-r6xc-hf3v/GHSA-f794-r6xc-hf3v.json
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
