CVE-2024-23647

描述

Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offers. PKCE adds the code_challenge parameter to the authorization request and adds the code_verifier parameter to the token request. Prior to 2023.8.7 and 2023.10.7, a downgrade scenario is possible: if the attacker removes the code_challenge parameter from the authorization request, authentik will not do the PKCE check. Because of this bug, an attacker can circumvent the protection PKCE offers, such as CSRF attacks and code injection attacks. Versions 2023.8.7 and 2023.10.7 fix the issue.

如何修補 CVE-2024-23647

要修補 CVE-2024-23647,請將受影響套件升級到下列已修補版本。

• —升級至 2023.8.7 或更新版本
• —升級至 2023.10.7 或更新版本
• —未列出修補版本

CVE-2024-23647 正在被利用嗎?

低 — EPSS 為 0.5%,目前沒有觀察到大規模利用活動。

受影響套件(3)

• from 0, < 2023.8.7, >= 2023.10.0, < 2023.10.7
• >= 2023.10.0, < 2023.10.7
• from 0

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-23647
• PATCHgithub.com/goauthentik/authentik
• WEBgithub.com/goauthentik/authentik/commit/38e04ae12720e5d81b4f7ac77997eb8d1275d31a
• WEBgithub.com/goauthentik/authentik/security/advisories/GHSA-mrx3-gxjx-hjqj