CVE-2023-50708: yii2-authclient vulnerable to possible timing attack
Summary
CVE-2023-50708: Impact _What kind of vulnerability is it? Affects yiisoft/yii2-authclient versions < 2.2.15. Fixed in 2.2.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
yii2-authclient is a package in the Packagist ecosystem that provides OAuth1, OAuth2, and OpenID Connect implementation for Yii2 framework. It allows developers to easily integrate third-party authentication services into their Yii2 applications. However, the package is vulnerable to a possible timing attack in its OAuth1, OAuth2, and OpenID Connect implementation.
Vulnerability Detail
The vulnerability lies in the comparison of the "state" parameter in OAuth1 and OAuth2, and the "nonce" parameter in OpenID Connect. These parameters are compared using regular string comparison instead of using a secure comparison method like Yii::$app->getSecurity()->compareString(). This makes the parameters susceptible to a timing attack, where an attacker can exploit the timing differences in string comparison to guess the correct value of the parameter.
How To Fix
Minimum fixed version
2.2.15
This is the first release that contains the fix.
composer require yiisoft/yii2-authclient:2.2.15Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Users must apply the provided fix or upgrade to a patched version of yii2-authclient.
Conclusion
In conclusion, yii2-authclient is vulnerable to a possible timing attack in its OAuth1, OAuth2, and OpenID Connect implementation. Users should apply the provided fix or upgrade to version 2.2.15 or higher to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yiisoft/yii2-authclient →
FAQ
The vulnerability allows an attacker to potentially guess the correct value of the "state" and "nonce" parameters, which can lead to unauthorized access or other security breaches.
Users of yii2-authclient versions up to 2.2.14 are affected by this vulnerability.
Yes, the vulnerability has been patched in version 2.2.15 of yii2-authclient.
No, the vulnerability can only be fixed by applying the provided code changes or upgrading to a patched version.
More information about this vulnerability can be found in the GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-w8vh-p74j-x9xp/GHSA-w8vh-p74j-x9xp.json
References
Related vulnerabilities
Recent vulnerabilities recorded for yiisoft/yii2-authclient.
