582812b3ec
website: Copy files during build. website: Allow for mixed env builds. website: Reduce build size. website: Expose build. website: Add build memory debugging. WIP: Disable broken links check to compare memory usage. website: Update deps. website: Clean up API paths. website: Flesh out 3.8 fixes. Format. website: Update ignore paths. Website: Clean up integrations build. website: Fix paths. website: Optimize remark. website: Update deps. website: Format. website: Remove linking. website: Fix paths. wip: Attempt API only build. Prep. Migrate render to runtime. Tidy sidebar. Clean up templates. docs: Move directory. WIP docs: Flesh out split. website: Fix issue where routes have collisions.
1.0 KiB
CVE-2024-47077
Reported by @quentinmit
Insufficient cross-provider token validation during introspection
Summary
Access tokens issued to one application can be stolen by that application and used to impersonate the user against any other proxy provider. Also, a user can steal an access token they were legitimately issued for one application and use it to access another application that they aren't allowed to access.
Details
The proxy provider uses /application/o/introspect/ to validate bearer tokens provided in the Authorization header:
The implementation of this endpoint separately validates the client_id and client_secret (which are that of the proxy provider) and the token without validating that they correspond to the same provider.
Patches
authentik 2024.6.5 and 2024.8.3 fix this issue.
For more information
If you have any questions or comments about this advisory:
- Email us at security@goauthentik.io