CVE-2023-50714: Vulnerability in yiisoft/yii2-authclient's Oauth2 PKCE Implementation
Summary
CVE-2023-50714: yiisoft/yii2-authclient's Oauth2 PKCE implementation is vulnerable. Affects yiisoft/yii2-authclient versions < 2.2.15. Fixed in 2.2.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The yiisoft/yii2-authclient package is a popular PHP library that provides OAuth client integration for Yii2 applications. It allows developers to easily implement OAuth authentication with various providers. The package is widely used in web applications and APIs built on the Yii2 framework. However, the Oauth2 PKCE implementation in versions prior to 2.2.15 is vulnerable to two issues. Firstly, the 'authCodeVerifier' is not removed after usage, similar to 'authState'. Secondly, there is a risk of a 'downgrade attack' if PKCE is relied upon for CSRF protection.
Vulnerability Detail
The vulnerability in yiisoft/yii2-authclient's Oauth2 PKCE implementation can have several consequences. Firstly, the failure to remove the 'authCodeVerifier' after usage can lead to potential security risks, as an attacker may be able to exploit the retained value. Secondly, the reliance on PKCE for CSRF protection can be undermined by a 'downgrade attack', allowing an attacker to bypass the intended security measures. These vulnerabilities can potentially result in unauthorized access, data breaches, and other security compromises.
How To Fix
Minimum fixed version
2.2.15
This is the first release that contains the fix.
composer require yiisoft/yii2-authclient:2.2.15Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is currently no known workaround for this vulnerability. Users are advised to upgrade to the patched version as soon as possible.
Conclusion
The yiisoft/yii2-authclient package's Oauth2 PKCE implementation is vulnerable to two issues that can lead to unauthorized access and other security compromises. Users should upgrade to version 2.2.15 or later to fix the vulnerability. It is recommended to update the package as soon as possible and thoroughly test the application after the update. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for yiisoft/yii2-authclient →
FAQ
The vulnerability can lead to unauthorized access, data breaches, and other security compromises in applications that use yiisoft/yii2-authclient's Oauth2 PKCE implementation.
To fix this vulnerability, upgrade to version 2.2.15 or later of the yiisoft/yii2-authclient package.
No, there is currently no known workaround for this vulnerability.
Using the vulnerable version of the package poses a security risk. It is strongly recommended to upgrade to the patched version.
You can find more information about this vulnerability in the GitHub Security Advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-rw54-6826-c8j5/GHSA-rw54-6826-c8j5.json
References
Related vulnerabilities
Recent vulnerabilities recorded for yiisoft/yii2-authclient.
