oauth CSRF vulnerability
Résumé
oauth CSRF vulnerability
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In the OAuth library for nim prior to version 0.11, the Authorization Code grant and Implicit grant both rely on the state parameter to prevent cross-site request forgery (CSRF) attacks where a resource owner might have their session associated with protected resources belonging to an attacker. When this project is compiled with certain compiler flags set, it is possible that the state parameter will not be checked at all, creating a CSRF vulnerability. Version 0.11 checks the state parameter using a regular if statement or doAssert instead of relying on a plain assert. doAssert will achieve the desired behavior even if -d:danger or --assertions:off is set.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com
- web github.com