~ / search / GHSA-j7vx-8mqj-cqp9

GHSA-j7vx-8mqj-cqp9

Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper

Source: GitHub Advisory Database (reviewed) High CVE-2020-10187

Packages

EcosystemPackageAffectedFixed in
RubyGems doorkeeper >= 5.0.0, < 5.0.3 5.0.3
RubyGems doorkeeper >= 5.1.0, < 5.1.1 5.1.1
RubyGems doorkeeper >= 5.2.0, < 5.2.5 5.2.5
RubyGems doorkeeper >= 5.3.0, < 5.3.2 5.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Information disclosure vulnerability. Allows an attacker to see all `Doorkeeper::Application` model attribute values (including secrets) using authorized applications controller if it's enabled (GET /oauth/authorized_applications.json). ### Patches These versions have the fix: * 5.0.3 * 5.1.1 * 5.2.5 * 5.3.2 ### Workarounds Patch `Doorkeeper::Application` model `#as_json(options = {})` method and define only those attributes you want to expose. Additional recommended hardening is to enable application secrets hashing ([guide](https://doorkeeper.gitbook.io/guides/security/token-and-application-secrets)), available since Doorkeeper 5.1. This would render the exposed secret useless. ### References - Commit with fix: https://github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10187

References

External links from the advisory. They lead to third-party sites.