Improper Authentication
CVE-2024-49755
Summary
Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. IdentityServer's local API authentication handler performs insufficient validation of the "cnf" claim in "DPoP" access tokens. This allows an attacker to use leaked "DPoP" access tokens at local api endpoints even without possessing the private key for signing proof tokens. Note that this only impacts custom endpoints within an IdentityServer implementation that has explicitly used the "LocalApiAuthenticationHandler" for authentication. The vulnerability affects Duende.IdentityServer package versions 7.0.0-preview.1 through 7.0.7, verisons 6.3 and below are unaffected, as they do not support "DPoP" in Local APIs.
- HIGH
- NETWORK
- NONE
- UNCHANGED
- REQUIRED
- NONE
- LOW
- NONE
CWE-287 - Improper Authentication
Improper (or broken) authentication attacks are widespread, and have accounted for many of the worst data breaches in recent years. Improper authentication attacks are a class of vulnerabilities where an attacker impersonates a legitimate user by exploiting weaknesses in either session management or credential management to gain access to the user’s account. This can result in disclosure of sensitive information, and can lead to system compromise, theft, identity theft, and fraud.
References
Advisory Timeline
- Published
