Assentの脆弱性、Appleログインでなりすまし、修正版あり
Summary
Elixir向け認証ライブラリAssentのSign in with Apple対応に、他のユーザーになりすませる脆弱性が公表されました。Appleログインを提供しているアプリの開発チームは、修正版への更新と、アカウント連携の確認を進めてください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Elixir向け認証ライブラリAssentのSign in with Apple対応に、他のユーザーになりすませる脆弱性が公表されました。Appleログインを提供しているアプリの開発チームは、修正版への更新と、アカウント連携の確認を進めてください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| pow-auth | assent |
≥ a2d331e8c51376d6c0b04a81aad31e0b4d4d64a3, < 18898bde0296152165ae470078490e5798329b1b |
18898bde0296152165ae470078490e5798329b1b |
| Hex | assent |
≥ 0.1.25, < 0.3.2 |
0.3.2 |
Original description The description as published by the source.
Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback.
Apple posts the user's name to the callback endpoint in a user form parameter that the browser submits and the client controls. Assent.Strategy.Apple.callback/2 in lib/assent/strategies/apple.ex decodes that parameter, and fetch_user/2 merges it over the claims of the verified ID token, so the unverified map wins. An attacker who completes a Sign in with Apple login with their own Apple ID and edits the user parameter can replace sub, email, and any other claim. Applications that look up, link, or authorize accounts by the returned subject or email then act on the attacker's values.
This issue affects assent: from 0.1.25 before 0.3.2.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- package hex.pm
- package github.com
- patch github.com
- patch github.com
- web cna.erlef.org
- web osv.dev
- web github.com
- web repo.hex.pm