Critical Vulnerability in Google OAuth Client Java Package: IDToken Signature Verification Flaw
Summary
UBUNTU-CVE-2021-22573: The vulnerability is that IDToken verifier does not verify if token is properly signed. Affects google-oauth-client-java versions 1.28.0-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Google OAuth Client Java package is a library that facilitates the implementation of OAuth 2.0 authentication in Java applications. It allows developers to easily integrate Google authentication into their applications, providing a seamless user experience. However, a critical vulnerability has been identified in this package that compromises the security of token validation.
Vulnerability Detail
The vulnerability arises from the IDToken verifier's failure to ensure that tokens are properly signed. This oversight allows an attacker to present a compromised token with a custom payload, which can pass validation on the client side. As a result, unauthorized access to sensitive information may occur, leading to potential data breaches and exploitation of the application. The vulnerability is classified with a CVSS score of 8.7, indicating a high level of severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that your application implements additional checks on the token payload to validate its authenticity before processing. This can help mitigate the risks associated with the vulnerability until an upgrade is performed.
Conclusion
In summary, the Google OAuth Client Java package has a critical vulnerability related to IDToken signature verification. It is crucial to upgrade to the patched version to ensure the security of your application. Implementing additional checks can serve as a temporary measure until the upgrade is completed.
See every vulnerability recorded for google-oauth-client-java →
FAQ
The vulnerability is related to the improper verification of IDToken signatures, allowing attackers to use compromised tokens.
If exploited, this vulnerability can lead to unauthorized access and potential data breaches, compromising user information.
The affected versions include google-oauth-client-java versions prior to 1.33.3.
Yes, upgrading to version 1.33.3 or above will patch the vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in real-time using a manifest file like package-lock.json. Check your application using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for google-oauth-client-java.
