Ruby/doorkeeper/5.3.0

Doorkeeper is an OAuth 2 provider for Rails and Grape.

https://rubygems.org/gems/doorkeeper
MIT

4 Security Vulnerabilities

Doorkeeper Improper Authentication vulnerability

Published date: 2023-06-12T19:50:34Z
CVE: CVE-2023-34246
Links:

OAuth RFC 8252 says https://www.rfc-editor.org/rfc/rfc8252#section-8.6

the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. This includes the case where the user has previously approved an authorization request for a given client id

But Doorkeeper automatically processes authorization requests without user consent for public clients that have been previously approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.

Issue https://github.com/doorkeeper-gem/doorkeeper/issues/1589

Fix https://github.com/doorkeeper-gem/doorkeeper/pull/1646

Affected versions: ["5.5.0.rc1", "5.4.0", "5.4.0.rc2", "5.4.0.rc1", "5.3.3", "5.3.2", "5.3.1", "5.3.0", "5.2.6", "5.2.5", "5.2.4", "5.2.3", "5.2.2", "5.2.1", "5.2.0", "5.2.0.rc3", "5.2.0.rc2", "5.2.0.rc1", "5.1.2", "5.1.1", "5.1.0", "5.1.0.rc2", "5.1.0.rc1", "5.0.3", "5.0.2", "5.0.1", "5.0.0", "5.0.0.rc2", "5.0.0.rc1", "4.4.3", "4.4.2", "4.4.1", "4.4.0", "4.3.2", "4.3.1", "4.3.0", "4.2.6", "4.2.5", "4.2.0", "4.1.0", "4.0.0", "4.0.0.rc4", "4.0.0.rc3", "4.0.0.rc2", "4.0.0.rc1", "3.1.0", "3.0.1", "3.0.0", "3.0.0.rc2", "3.0.0.rc1", "2.2.2", "2.2.1", "2.2.0", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.0.1", "2.0.0", "2.0.0.rc3", "2.0.0.rc2", "2.0.0.alpha1", "1.4.2", "1.4.1", "1.4.0", "1.3.1", "1.3.0", "1.2.0", "1.1.0", "1.0.0", "1.0.0.rc2", "1.0.0.rc1", "0.7.4", "0.7.3", "0.7.2", "0.7.1", "0.7.0", "0.6.7", "0.6.6", "0.6.5", "0.6.4", "0.6.3", "0.6.2", "0.6.1", "0.6.0", "0.6.0.rc1", "0.5.0", "0.5.0.rc1", "0.4.2", "0.4.1", "0.4.0", "0.3.4", "0.3.3", "0.3.2", "0.3.1", "0.3.0", "0.2.0", "0.1.1", "0.1.0", "5.5.0.rc2", "5.5.0", "5.5.1", "5.5.2", "5.5.3", "5.5.4", "5.6.0.rc1", "5.6.0.rc2", "5.6.0", "5.6.1", "5.6.2", "5.6.3", "5.6.4", "5.6.5"]
Secure versions: [5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.7.0, 5.7.1, 5.8.0]
Recommendation: Update to version 5.8.0.

Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper

Published date: 2020-05-07T21:11:07Z
CVE: CVE-2020-10187
Links:

Impact

Information disclosure vulnerability. Allows an attacker to see all Doorkeeper::Application model attribute values (including secrets) using authorized applications controller if it's enabled (GET /oauth/authorized_applications.json).

Patches

These versions have the fix:

  • 5.0.3
  • 5.1.1
  • 5.2.5
  • 5.3.2

Workarounds

Patch Doorkeeper::Application model #as_json(options = {}) method and define only those attributes you want to expose.

Additional recommended hardening is to enable application secrets hashing (guide), available since Doorkeeper 5.1. This would render the exposed secret useless.

References

Affected versions: ["5.3.1", "5.3.0", "5.2.4", "5.2.3", "5.2.2", "5.2.1", "5.2.0", "5.1.0", "5.0.2", "5.0.1", "5.0.0"]
Secure versions: [5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.7.0, 5.7.1, 5.8.0]
Recommendation: Update to version 5.8.0.

Doorkeeper application secret information disclosure vulnerability

Published date: 2020-05-02
CVE: 2020-10187
CVSS V2: 5.5
CVSS V3: 5.4
Links:

Information disclosure vulnerability. Allows an attacker to see all Doorkeeper::Application model attribute values (including secrets) after authorizing an application to their user.

An application is vulnerable if the authorized applications controller is enabled (GET /oauth/authorized_applications.json).

Recommended additional hardening for >= 5.1 is to enable application secrets hashing. This would render the exposed secret useless.

Affected versions: ["5.3.1", "5.3.0"]
Secure versions: [5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.7.0, 5.7.1, 5.8.0]
Recommendation: Update to version 5.8.0.

Doorkeeper Improper Authentication vulnerability

Published date: 2023-06-12
CVE: 2023-34246
CVSS V3: 4.2
Links:

OAuth RFC 8252 says https://www.rfc-editor.org/rfc/rfc8252#section-8.6

the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. This includes the case where the user has previously approved an authorization request for a given client id

But Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.

Issue https://github.com/doorkeeper-gem/doorkeeper/issues/1589

Fix https://github.com/doorkeeper-gem/doorkeeper/pull/1646

Affected versions: ["5.5.0.rc1", "5.4.0", "5.4.0.rc2", "5.4.0.rc1", "5.3.3", "5.3.2", "5.3.1", "5.3.0", "5.2.6", "5.2.5", "5.2.4", "5.2.3", "5.2.2", "5.2.1", "5.2.0", "5.2.0.rc3", "5.2.0.rc2", "5.2.0.rc1", "5.1.2", "5.1.1", "5.1.0", "5.1.0.rc2", "5.1.0.rc1", "5.0.3", "5.0.2", "5.0.1", "5.0.0", "5.0.0.rc2", "5.0.0.rc1", "4.4.3", "4.4.2", "4.4.1", "4.4.0", "4.3.2", "4.3.1", "4.3.0", "4.2.6", "4.2.5", "4.2.0", "4.1.0", "4.0.0", "4.0.0.rc4", "4.0.0.rc3", "4.0.0.rc2", "4.0.0.rc1", "3.1.0", "3.0.1", "3.0.0", "3.0.0.rc2", "3.0.0.rc1", "2.2.2", "2.2.1", "2.2.0", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.0.1", "2.0.0", "2.0.0.rc3", "2.0.0.rc2", "2.0.0.alpha1", "1.4.2", "1.4.1", "1.4.0", "1.3.1", "1.3.0", "1.2.0", "1.1.0", "1.0.0", "1.0.0.rc2", "1.0.0.rc1", "0.7.4", "0.7.3", "0.7.2", "0.7.1", "0.7.0", "0.6.7", "0.6.6", "0.6.5", "0.6.4", "0.6.3", "0.6.2", "0.6.1", "0.6.0", "0.6.0.rc1", "0.5.0", "0.5.0.rc1", "0.4.2", "0.4.1", "0.4.0", "0.3.4", "0.3.3", "0.3.2", "0.3.1", "0.3.0", "0.2.0", "0.1.1", "0.1.0", "5.5.0.rc2", "5.5.0", "5.5.1", "5.5.2", "5.5.3", "5.5.4", "5.6.0.rc1", "5.6.0.rc2", "5.6.0", "5.6.1", "5.6.2", "5.6.3", "5.6.4", "5.6.5"]
Secure versions: [5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.7.0, 5.7.1, 5.8.0]
Recommendation: Update to version 5.8.0.

121 Other Versions

Version License Security Released
0.6.6 UNKNOWN 6 2013-01-04 - 14:29 almost 12 years
0.6.5 UNKNOWN 6 2012-12-26 - 22:45 almost 12 years
0.6.4 UNKNOWN 6 2012-12-15 - 19:51 almost 12 years
0.6.3 UNKNOWN 6 2012-12-07 - 00:02 almost 12 years
0.6.2 UNKNOWN 6 2012-11-10 - 21:37 about 12 years
0.6.1 UNKNOWN 6 2012-11-07 - 20:00 about 12 years
0.6.0 UNKNOWN 6 2012-11-05 - 22:07 about 12 years
0.6.0.rc1 UNKNOWN 6 2012-11-03 - 15:39 about 12 years
0.5.0 UNKNOWN 6 2012-10-20 - 03:38 about 12 years
0.5.0.rc1 UNKNOWN 6 2012-10-13 - 15:18 about 12 years
0.4.2 UNKNOWN 6 2012-06-05 - 18:26 over 12 years
0.4.1 UNKNOWN 6 2012-06-02 - 10:11 over 12 years
0.4.0 UNKNOWN 6 2012-05-26 - 14:03 over 12 years
0.3.4 UNKNOWN 6 2012-05-24 - 18:48 over 12 years
0.3.3 UNKNOWN 6 2012-05-08 - 16:53 over 12 years
0.3.2 UNKNOWN 6 2012-04-29 - 20:13 over 12 years
0.3.1 UNKNOWN 6 2012-02-17 - 22:20 over 12 years
0.3.0 UNKNOWN 6 2012-02-11 - 11:32 almost 13 years
0.2.0 UNKNOWN 6 2011-12-17 - 20:17 almost 13 years
0.1.1 UNKNOWN 6 2011-11-30 - 13:56 almost 13 years
0.1.0 UNKNOWN 6 2011-11-28 - 16:24 almost 13 years