Vulnerability · Published Oct 9, 2023 · Assigned by GitHub_M
CVE-2023-36820micronaut security has invalid IdTokenClaimsValidator logic on aud
Medium 4.8
In plain English
A medium-severity improper access control in micronaut-security from micronaut-projects. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared. This issue has been patched in versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | io.micronaut.security:micronaut-security-oauth2 | 3.11.1 | GHSA-qw22-8w9r-864h |
| Maven | io.micronaut.security:micronaut-security-oauth2 | 3.10.2 | GHSA-qw22-8w9r-864h |
| Maven | io.micronaut.security:micronaut-security-oauth2 | 3.9.6 | GHSA-qw22-8w9r-864h |
| Maven | io.micronaut.security:micronaut-security-oauth2 | 3.8.4 | GHSA-qw22-8w9r-864h |
| Maven | io.micronaut.security:micronaut-security-oauth2 | 3.7.4 | GHSA-qw22-8w9r-864h |
| Maven | io.micronaut.security:micronaut-security-oauth2 | 3.6.6 | GHSA-qw22-8w9r-864h |
| Maven | io.micronaut.security:micronaut-security-oauth2 | 3.5.3 | GHSA-qw22-8w9r-864h |
| Maven | io.micronaut.security:micronaut-security-oauth2 | 3.4.3 | GHSA-qw22-8w9r-864h |
| Maven | io.micronaut.security:micronaut-security-oauth2 | 3.3.2 | GHSA-qw22-8w9r-864h |
| Maven | io.micronaut.security:micronaut-security-oauth2 | 3.2.4 | GHSA-qw22-8w9r-864h |
| Maven | io.micronaut.security:micronaut-security-oauth2 | 3.1.2 | GHSA-qw22-8w9r-864h |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| micronaut-projects | micronaut-security | >= 3.11.0, < 3.11.1>= 3.10.0, < 3.10.2>= 3.9.0, < 3.9.6>= 3.8.0, < 3.8.4>= 3.7.0, < 3.7.4>= 3.6.0, < 3.6.6>= 3.5.0, < 3.5.3>= 3.4.0, < 3.4.3 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N