CVE-2021-22573: Improper Verification of Cryptographic Signature in google-oauth-java-client
Summary
GHSA-xh97-72ww-2w58: Duplicate Advisory: Improper Verification of Cryptographic Signature in google-oauth-java-client. Affects com.google.oauth-client:google-oauth-client versions >= 1.16.0-rc, < 1.33.3. Fixed in 1.33.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The google-oauth-java-client is an open-source library that provides support for OAuth 2.0 authentication in Java applications. It allows developers to integrate with Google APIs and services using OAuth 2.0 tokens. The library includes features for verifying the authenticity and integrity of ID tokens issued by Google. However, a vulnerability in the IdTokenVerifier class allows an attacker to bypass signature verification and modify the token's payload, potentially leading to unauthorized access or data manipulation.
Vulnerability Detail
The vulnerability arises from the lack of proper signature verification in the verify method of the IdTokenVerifier class. This means that the library does not validate the signature before verifying the claims in the token. An attacker can exploit this by providing a compromised token with a modified payload, such as email or phone number. The token will pass the validation by the library, allowing the attacker to use the modified payload in the application. While the risk is low if the verified IdToken is only used internally, if it is sent to other services without further signature verification, the risk increases. The vulnerability has a CVSS score of 7.3, indicating a high severity.
How To Fix
Minimum fixed version
1.33.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the library is not feasible or if the library is indirectly used and cannot be updated, alternative IdToken verifiers provided by Google can be used. For example, the google-auth-library-java and google-api-java-client libraries offer similar IdToken verifiers that already include signature verification. Developers can consider using these alternative libraries to mitigate the vulnerability.
Conclusion
The vulnerability in the google-oauth-java-client library allows an attacker to bypass signature verification and modify the payload of ID tokens. This can lead to unauthorized access or data manipulation in the application. It is crucial to update the library to version 1.33.3 or higher to fix the vulnerability. Alternatively, using alternative IdToken verifiers provided by Google can also mitigate the issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.google.oauth-client:google-oauth-client →
FAQ
The vulnerability allows an attacker to provide a compromised token with a modified payload, potentially leading to unauthorized access or data manipulation in the application.
Updating the google-oauth-java-client library to version 1.33.3 or higher fixes the vulnerability. Alternatively, using alternative IdToken verifiers provided by Google can also mitigate the issue.
If updating the library is not feasible, using alternative IdToken verifiers provided by Google can serve as a workaround.
There are no known public exploits of this vulnerability at the time of disclosure.
For more information, you can refer to the GitHub advisory for this vulnerability or contact the developers of the google-oauth-java-client library.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.google.oauth-client:google-oauth-client.
