Bug 2219737 (CVE-2023-31999)

Summary:	CVE-2023-31999 fastify-oauth2: CSRF due to reused Oauth2 state
Product:	[Other] Security Response	Reporter:	TEJ RATHI <trathi>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	mbenatto, nboldt, scorneli, zmiele
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	fastify-oauth2 7.2.0	Doc Type:	If docs needed, set a value
Doc Text:	A Cross-Site Request Forgery (CSRF) flaw was found in Oauth2. This issue exists due to the state parameter being statically generated at startup time and used across all requests for all users. An attacker could use the value of the state parameter to create forged requests on behalf of other users or other sessions of the same user.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2219738

Description TEJ RATHI 2023-07-05 04:22:12 UTC

All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the Oauth2 state parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be unique per user and should be connected to the user's session in some way that will allow the server to validate it.

v7.2.0 changes the default behavior to store the state in a cookie with the http-only and same-site=lax attributes set. The state is now by default generated for every user. Note that this contains a breaking change in the checkStateFunction function, which now accepts the full Request object.

https://auth0.com/docs/secure/attack-protection/state-parameters
https://github.com/fastify/fastify-oauth2/security/advisories/GHSA-g8x5-p9qc-cf95
https://hackerone.com/reports/2020418
https://github.com/fastify/fastify-oauth2/releases/tag/v7.2.0

Comment 3 Marco Benatto 2023-07-07 20:08:09 UTC

*** Bug 2221300 has been marked as a duplicate of this bug. ***