Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper
High severity
GitHub Reviewed
Published
May 2, 2020
in
doorkeeper-gem/doorkeeper
•
Updated May 4, 2023
Package
Affected versions
>= 5.0.0, < 5.0.3
= 5.1.0
>= 5.2.0, < 5.2.5
>= 5.3.0, < 5.3.2
Patched versions
5.0.3
5.1.1
5.2.5
5.3.2
Description
Published by the National Vulnerability Database
May 4, 2020
Reviewed
May 7, 2020
Published to the GitHub Advisory Database
May 7, 2020
Last updated
May 4, 2023
Credits
-
stefansundin Analyst
-
nbulaj Analyst
Impact
Information disclosure vulnerability. Allows an attacker to see all
Doorkeeper::Applicationmodel attribute values (including secrets) using authorized applications controller if it's enabled (GET /oauth/authorized_applications.json).Patches
These versions have the fix:
Workarounds
Patch
Doorkeeper::Applicationmodel#as_json(options = {})method and define only those attributes you want to expose.Additional recommended hardening is to enable application secrets hashing (guide), available since Doorkeeper 5.1. This would render the exposed secret useless.
References
References