github - ghsa-6rrr-78xp-5jp8

ghsa-6rrr-78xp-5jp8

Vulnerability from github

Published

2023-01-11 18:27

Modified

2023-01-24 18:55

Severity ?

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

Summary

Zitadel RefreshToken invalidation vulnerability

Details

Impact

RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI.

RefreshTokens were not invalidated when a user was locked or deactivated. The deactivated or locked user was able to obtain a valid access token only through a refresh token grant.

When the locked or deactivated user’s session was already terminated (“logged out”) then it was not possible to create a new session. Renewal of access token through a refresh token grant is limited to the configured amount of time (RefreshTokenExpiration).

Patches

2.x versions are fixed on >= 2.17.3 2.16.x versions are fixed on >= 2.16.4

ZITADEL recommends upgrading to the latest versions available in due course.

Workarounds

Ensure the RefreshTokenExpiration in the OIDC settings of your instance is set according to your security requirements.

References

https://zitadel.com/docs/guides/manage/console/instance-settings#oidc-token-lifetimes-and-expiration

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zitadel/zitadel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.17.0"
            },
            {
              "fixed": "2.17.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zitadel/zitadel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.16.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-22492"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-11T18:27:48Z",
    "nvd_published_at": "2023-01-11T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nRefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user\u0027s session without the need for interacting with a UI.\n\nRefreshTokens were not invalidated when a user was locked or deactivated. The deactivated or locked user was able to obtain a valid access token only through a refresh token grant.\n\nWhen the locked or deactivated user\u2019s session was already terminated (\u201clogged out\u201d) then it was not possible to create a new session. Renewal of access token through a refresh token grant is limited to the configured amount of time (RefreshTokenExpiration).\n\n### Patches\n2.x versions are fixed on \u003e= [2.17.3](https://github.com/zitadel/zitadel/releases/tag/v2.17.3)\n2.16.x versions are fixed on \u003e= [2.16.4](https://github.com/zitadel/zitadel/releases/tag/v2.16.4)\n\nZITADEL recommends upgrading to the latest versions available in due course.\n\n### Workarounds\nEnsure the RefreshTokenExpiration in the OIDC settings of your instance is set according to your security requirements.\n\n### References\n\nhttps://zitadel.com/docs/guides/manage/console/instance-settings#oidc-token-lifetimes-and-expiration\n",
  "id": "GHSA-6rrr-78xp-5jp8",
  "modified": "2023-01-24T18:55:45Z",
  "published": "2023-01-11T18:27:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-6rrr-78xp-5jp8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22492"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/commit/301e22c4956ead6014a8179463c37263f7301a83"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/commit/fc892c52a10cd4ffdac395747494f3a93a7494c2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/zitadel/zitadel"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.16.4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.17.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Zitadel RefreshToken invalidation vulnerability"
}

CVE-2023-22492 (GCVE-0-2023-22492)

Vulnerability from cvelistv5

Published

2023-01-11 19:42

Modified

2025-03-10 21:30

Severity ?

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

CWE

CWE-613 - Insufficient Session Expiration

Summary

ZITADEL is a combination of Auth0 and Keycloak. RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI. RefreshTokens were not invalidated when a user was locked or deactivated. The deactivated or locked user was able to obtain a valid access token only through a refresh token grant. When the locked or deactivated user’s session was already terminated (“logged out”) then it was not possible to create a new session. Renewal of access token through a refresh token grant is limited to the configured amount of time (RefreshTokenExpiration). As a workaround, ensure the RefreshTokenExpiration in the OIDC settings of your instance is set according to your security requirements. This issue has been patched in versions 2.17.3 and 2.16.4.

References

►

URL

Tags

	https://github.com/zitadel/zitadel/security/advisories/GHSA-6rrr-78xp-5jp8	x_refsource_CONFIRM
	https://github.com/zitadel/zitadel/commit/301e22c4956ead6014a8179463c37263f7301a83	x_refsource_MISC
	https://github.com/zitadel/zitadel/commit/fc892c52a10cd4ffdac395747494f3a93a7494c2	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	zitadel	zitadel	Version: >= 2.17.0, < 2.17.3 Version: >= 2.0.0, < 2.16.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T10:13:48.665Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-6rrr-78xp-5jp8",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-6rrr-78xp-5jp8"
          },
          {
            "name": "https://github.com/zitadel/zitadel/commit/301e22c4956ead6014a8179463c37263f7301a83",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/zitadel/zitadel/commit/301e22c4956ead6014a8179463c37263f7301a83"
          },
          {
            "name": "https://github.com/zitadel/zitadel/commit/fc892c52a10cd4ffdac395747494f3a93a7494c2",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/zitadel/zitadel/commit/fc892c52a10cd4ffdac395747494f3a93a7494c2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-22492",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-10T21:00:16.231923Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-10T21:30:41.038Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "zitadel",
          "vendor": "zitadel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.17.0, \u003c 2.17.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.16.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ZITADEL is a combination of Auth0 and Keycloak. RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user\u0027s session without the need for interacting with a UI. RefreshTokens were not invalidated when a user was locked or deactivated. The deactivated or locked user was able to obtain a valid access token only through a refresh token grant. When the locked or deactivated user\u2019s session was already terminated (\u201clogged out\u201d) then it was not possible to create a new session. Renewal of access token through a refresh token grant is limited to the configured amount of time (RefreshTokenExpiration). As a workaround, ensure the RefreshTokenExpiration in the OIDC settings of your instance is set according to your security requirements. This issue has been patched in versions 2.17.3 and 2.16.4. "
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613: Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-11T19:42:50.505Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-6rrr-78xp-5jp8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-6rrr-78xp-5jp8"
        },
        {
          "name": "https://github.com/zitadel/zitadel/commit/301e22c4956ead6014a8179463c37263f7301a83",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/commit/301e22c4956ead6014a8179463c37263f7301a83"
        },
        {
          "name": "https://github.com/zitadel/zitadel/commit/fc892c52a10cd4ffdac395747494f3a93a7494c2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/commit/fc892c52a10cd4ffdac395747494f3a93a7494c2"
        }
      ],
      "source": {
        "advisory": "GHSA-6rrr-78xp-5jp8",
        "discovery": "UNKNOWN"
      },
      "title": "RefreshToken invalidation vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-22492",
    "datePublished": "2023-01-11T19:42:50.505Z",
    "dateReserved": "2022-12-29T17:41:28.089Z",
    "dateUpdated": "2025-03-10T21:30:41.038Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-6rrr-78xp-5jp8

Vulnerability from github

Impact

Patches

Workarounds

References

CVE-2023-22492 (GCVE-0-2023-22492)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature