Insecure OAuth 2.0 Implementation in Google OAuth Client Java Package
Summary
DEBIAN-CVE-2020-7692: PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Affects google-oauth-client-java versions < 1.28.0-2. Fixed in 1.28.0-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Google OAuth Client Java package is a library that facilitates the integration of OAuth 2.0 authentication in Java applications. It allows developers to easily implement secure authorization flows for accessing protected resources. However, the package has a vulnerability related to the implementation of Proof Key for Code Exchange (PKCE), which is crucial for securing authorization codes in native applications.
Vulnerability Detail
The vulnerability arises from the lack of proper implementation of PKCE as per the RFC for OAuth 2.0 for Native Apps. This oversight means that the authorization code returned by the authorization server cannot guarantee that the client making the request is the one that will be authorized. Consequently, an attacker could exploit this weakness by obtaining the authorization code through a malicious app on the client-side, leading to unauthorized access to protected resources. This issue affects versions of the package prior to 1.31.0.
How To Fix
Minimum fixed version
1.28.0-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade google-oauth-client-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to update the package to the patched version as mentioned above.
Conclusion
The Google OAuth Client Java package has a critical vulnerability due to the improper implementation of PKCE, which can lead to unauthorized access to protected resources. It is crucial for developers to update to the patched version to mitigate this risk. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in open-source software effectively.
See every vulnerability recorded for google-oauth-client-java →
FAQ
PKCE, or Proof Key for Code Exchange, is a security extension for OAuth 2.0 that helps prevent authorization code interception attacks. It ensures that the authorization code can only be exchanged by the client that initiated the request.
If this vulnerability is not addressed, attackers could potentially gain unauthorized access to sensitive user data by intercepting authorization codes, leading to data breaches and compromised user accounts.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
While there are no specific workarounds, it is advisable to limit the exposure of your application and monitor for any suspicious activity until the package can be updated.
Detailed information about this vulnerability can be found in the Debian CVE database, specifically under DEBIAN-CVE-2020-7692.
References
Related vulnerabilities
Recent vulnerabilities recorded for google-oauth-client-java.
