MEDIUM
GHSA-583x-23h9-f5w7
Strapi does not verify the access or ID tokens issued during the OAuth flow
Quick fix
GHSA-583x-23h9-f5w7 — @strapi/plugin-users-permissions: upgrade to the fixed version with the command below.
npm install @strapi/plugin-users-permissions@4.6.0Details
Strapi 3.2.1 until 4.6.0 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.
Are you affected?
Enter the version of the package you're using.
Affected packages
npm/@strapi/plugin-users-permissions
Introduced in:
3.2.1Fixed in: 4.6.0Fix
npm install @strapi/plugin-users-permissions@4.6.0References
- https://nvd.nist.gov/vuln/detail/CVE-2023-22893[ADVISORY]
- https://github.com/strapi/strapi/commit/46f8f98378338f18b5c6139d0157a8f71bf4de83[WEB]
- https://github.com/strapi/strapi/commit/8bbbd7383a20bb7cb163c8b462baffee559e994f[WEB]
- https://github.com/strapi/strapi/commit/eeab43b57707d7ef275076d27be6eabc72bd71a7[WEB]
- https://github.com/strapi/strapi[PACKAGE]
- https://github.com/strapi/strapi/blob/v4.5.6/packages/plugins/users-permissions/server/services/providers-registry.js[WEB]
- https://github.com/strapi/strapi/releases[WEB]
- https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve[WEB]
- https://www.ghostccamm.com/blog/multi_strapi_vulns[WEB]