CVE-2024-23647

Published Jan 30, 2024

Last updated 9 months ago

Overview

Description: Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offers. PKCE adds the code_challenge parameter to the authorization request and adds the code_verifier parameter to the token request. Prior to 2023.8.7 and 2023.10.7, a downgrade scenario is possible: if the attacker removes the code_challenge parameter from the authorization request, authentik will not do the PKCE check. Because of this bug, an attacker can circumvent the protection PKCE offers, such as CSRF attacks and code injection attacks. Versions 2023.8.7 and 2023.10.7 fix the issue.
Source: security-advisories@github.com
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-287

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "026E19BC-D2BB-4B89-916F-565B498F0C87",
            "versionEndExcluding": "2023.8.7"
          },
          {
            "criteria": "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6E579B4B-ACB8-4917-915B-D0FB5FC17F64",
            "versionEndExcluding": "2023.10.7",
            "versionStartIncluding": "2023.10.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

Weaknesses

Configurations

References