Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS12OXhxLTJtdm0teDh4Y84ABAuY

Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs

Impact

IdentityServer's local API authentication handler performs insufficient validation of the cnf claim in DPoP access tokens. This allows an attacker to use leaked DPoP access tokens at local api endpoints even without possessing the private key for signing proof tokens.

Note that this only impacts custom endpoints within an IdentityServer implementation that have explicitly used the LocalApiAuthenticationHandler for authentication. It does not impact:

OAuth or OIDC protocol endpoints defined by IdentityServer, such as the authorize and token endpoints.
Typical UI pages within an IdentityServer implementation, which are not normally authorized with the local API authentication handler.
The use of DPoP to create sender-constrained tokens in IdentityServer that are consumed by external API resources.
The use of DPoP to sender-constrain refresh tokens issued to public clients.

Are you affected?

This vulnerability only affects IdentityServer implementations that are using the local APIs feature of IdentityServer and have explicitly enabled DPoP for local APIs. The local api authentication handler is configured with a call to either AddLocalApi or AddLocalApiAuthentication, and the opt-in to DPoP for local APIs is enabled via the TokenMode option.

Vulnerable implementations of IdentityServer would have configuration code similar to the following:

services.AddAuthentication()
    .AddLocalApi("local", options => 
    {
        options.TokenMode = LocalApiTokenMode.DPoPAndBearer; // or LocalApiTokenMode.DPoPOnly
    });

Patches

This vulnerability is patched in IdentityServer 7.0.8. Version 6.3 and below are unaffected, as they do not support DPoP in Local APIs.

Permalink: https://github.com/advisories/GHSA-v9xq-2mvm-x8xc
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12OXhxLTJtdm0teDh4Y84ABAuY
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: 9 days ago
Updated: 9 days ago

CVSS Score: 3.1
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Identifiers: GHSA-v9xq-2mvm-x8xc, CVE-2024-49755
References:

Repository: https://github.com/DuendeSoftware/IdentityServer
Blast Radius: 1.0

Affected Packages

nuget:Duende.IdentityServer

Dependent packages: 43
Dependent repositories: 0
Downloads: 10,912,394 total
Affected Version Ranges: >= 7.0.0, < 7.0.8
Fixed in: 7.0.8
All affected versions: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7
All unaffected versions: 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.1.0, 5.1.1, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.1.0, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 7.0.8