CVE-2021-32701: Incorrect Authorization in ORY Oathkeeper
Summary
CVE-2021-32701: Incorrect Authorization in ORY Oathkeeper. Affects github.com/ory/oathkeeper versions >= 0.38.0-beta.2, < 0.38.12-beta.1. Fixed in 0.38.12-beta.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. It provides functionality for validating access tokens and enforcing access control policies. The vulnerability in ORY Oathkeeper allows unauthorized access to endpoints that require specific scopes. This vulnerability exists in versions 0.38.0-beta.2 to 0.38.11-beta.1 of the package 'github.com/ory/oathkeeper'.
Vulnerability Detail
The vulnerability arises when a request is made to an endpoint that requires a certain scope using an access token granted with that scope. If a second request is made to an endpoint that requires a different scope before the cache has expired, the introspection will still be valid, regardless of whether the token is granted the required scope or not. This allows unauthorized access to endpoints that should be restricted. The vulnerability was introduced in PR #424 and was not caught during the review process due to a lack of appropriate test coverage.
How To Fix
Minimum fixed version
0.38.12-beta.1
This is the first release that contains the fix.
go get github.com/ory/oathkeeper@v0.38.12-beta.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately possible, a workaround is to disable caching for the 'oauth2_introspection' authenticator. By disabling caching, the vulnerability is mitigated. However, this may impact performance, so it is recommended to update to the patched version as soon as feasible. To disable caching, modify the configuration of the 'oauth2_introspection' authenticator to set the cache duration to zero.
Conclusion
The vulnerability in ORY Oathkeeper allows unauthorized access to endpoints that require specific scopes. It is important to update to the patched version (0.38.12-beta.1 or later) of the 'github.com/ory/oathkeeper' package to mitigate this vulnerability. If immediate updating is not possible, disabling caching for the 'oauth2_introspection' authenticator can serve as a temporary workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/ory/oathkeeper →
FAQ
ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. It provides functionality for validating access tokens and enforcing access control policies.
The vulnerability allows unauthorized access to endpoints that require specific scopes. This can lead to unauthorized actions being performed by attackers who exploit the vulnerability.
Versions 0.38.0-beta.2 to 0.38.11-beta.1 of the 'github.com/ory/oathkeeper' package are affected by this vulnerability.
To fix this vulnerability, update to version 0.38.12-beta.1 or later of the 'github.com/ory/oathkeeper' package. This version includes a patch that addresses the incorrect authorization issue.
Yes, a workaround is to disable caching for the 'oauth2_introspection' authenticator. This can be done by modifying the configuration to set the cache duration to zero. However, it is recommended to update to the patched version as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ory/oathkeeper.
