CVE-2022-31053: Improper Verification of Cryptographic Signature in biscuit-haskell
Summary
CVE-2022-31053: Improper Verification of Cryptographic Signature. Affects biscuit-haskell versions >= 0.1.0.0, < 0.2.0.0. Fixed in 0.2.0.0. How to fix ↓
Also tracked for
- github.com/biscuit-auth/biscuit-go · Go
- github.com/biscuit-auth/biscuit-go · Go
- biscuit-auth · crates.io
The same CVE-2022-31053 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
biscuit-haskell is a package available on Hackage that implements the Biscuit specification version 1. Biscuit is a token format that provides authorization capabilities for distributed systems. It allows users to define access policies and issue tokens with specific permissions. However, the version 1 of the Biscuit specification contains a vulnerability that enables malicious actors to forge valid γ-signatures. This vulnerability allows an attacker to create a token with any access level. It's important to note that the version 2 of the specification mandates a different algorithm and is not affected by this vulnerability.
Vulnerability Detail
The vulnerability in biscuit-haskell arises from an improper verification of cryptographic signatures. By exploiting this flaw, an attacker can create tokens with arbitrary access levels, bypassing the intended authorization mechanisms. This can lead to unauthorized access to sensitive resources and potential privilege escalation. The vulnerability is specific to the Biscuit specification version 1 and does not affect version 2, which uses a different algorithm. The severity of this vulnerability is rated as critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
How To Fix
Minimum fixed version
0.2.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to a fixed version of the biscuit-haskell package to mitigate the risk.
Conclusion
The vulnerability in biscuit-haskell allows for the improper verification of cryptographic signatures, enabling attackers to forge valid γ-signatures and create tokens with arbitrary access levels. To mitigate this risk, it is crucial to update to version 0.2.0.0 or later of the biscuit-haskell package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for biscuit-haskell →
FAQ
The vulnerability allows attackers to forge valid γ-signatures, enabling them to create tokens with any access level. This can lead to unauthorized access to sensitive resources and potential privilege escalation.
No, version 2 of the Biscuit specification uses a different algorithm and is not affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
There are no known exploits of this vulnerability at the time of this report. However, it is crucial to update to a fixed version of the biscuit-haskell package to prevent potential attacks.
You can find more information about this vulnerability in the biscuit-haskell package's security advisory at https://github.com/haskell/security-advisories/blob/generated/osv-export/2023/HSEC-2023-0002.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for biscuit-haskell.
