{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/ubuntu/authd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20240930103526-63e527496b01"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/ubuntu/authd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.0"
            },
            {
              "fixed": "0.3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-9313"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-03T16:53:07Z",
    "nvd_published_at": "2024-10-03T11:15:13Z",
    "severity": "HIGH"
  },
  "details": "Authd PAM module up to version 0.3.4 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them.\n\nThis is possible using tools such as `su`, `sudo` or `ssh` (and potentially others) that, so far, do not ensure that the PAM user at the end of the transaction is matching the one who initiated the transaction.\n\nAuthd 0.3.5 fixes this by not allowing changing the user unless it was never set before in the PAM stack.\n\n`su` version that will include https://github.com/util-linux/util-linux/pull/3206 will not be affected\n`ssh` version that will include https://github.com/openssh/openssh-portable/pull/521 will not be affected\n`sudo` version that will include https://github.com/sudo-project/sudo/pull/412 will not be affected\n`login` not affected\n`passwd` not affected\n\n\u003cdetails\u003e\n\u003csummary\u003eOld report\u003c/summary\u003e\n\n### Summary\n\nAn user can access as another user using its own credentials\n\n### Details\n\nI feel we\u2019ve a security issue that is due to the fact that we allow changing the user in the cases in which that\u2019s already provided by PAM, I\u2019ve not tested this using the entra-id broker but it\u2019s reproducible with the example one, but unless I\u2019m missing something it should be independent from the broker in use.\n\nBasically, by going to the user selection page we allow to login as any user by entering the use own credentials.\n\nSee for example: https://asciinema.org/a/VIcjpDImomaGu0wxsJJxNdmlf or https://asciinema.org/a/CV3D1gaEhn2yclqSMKCnifYPo  \n\nBasically it\u2019s possible to logging in as `user1` using the credentials of `user2` or `user3`.\n\nThe issue doesn\u2019t affect login or passwd, but it does affect `su` and `sshd`, since in both cases they don\u2019t check if the `PAM_USER` changed before the final authentication.\n\nNow, while those tools should likely be fixed to only read the PAM_USER once pam gave them the final ok, I think authd should not allow changing the user at all when it has been provided by PAM.\n\u003c/details\u003e",
  "id": "GHSA-x5q3-c8rm-w787",
  "modified": "2025-01-21T17:19:31Z",
  "published": "2024-10-03T16:53:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ubuntu/authd/security/advisories/GHSA-x5q3-c8rm-w787"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9313"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ubuntu/authd/commit/63e527496b013bed46904c1c58be593c13ebdce5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ubuntu/authd"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2024-3181"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-9313"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "PAM module may allow accessing with the credentials of another user"
}