oauth CSRF vulnerability
概要
oauth CSRF vulnerability
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
In the OAuth library for nim prior to version 0.11, the Authorization Code grant and Implicit grant both rely on the state parameter to prevent cross-site request forgery (CSRF) attacks where a resource owner might have their session associated with protected resources belonging to an attacker. When this project is compiled with certain compiler flags set, it is possible that the state parameter will not be checked at all, creating a CSRF vulnerability. Version 0.11 checks the state parameter using a regular if statement or doAssert instead of relying on a plain assert. doAssert will achieve the desired behavior even if -d:danger or --assertions:off is set.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com
- web github.com