SuperTokens Coreに別アプリ乗っ取りの脆弱性、修正版あり
Summary
認証サーバーSuperTokens Coreで、1つのアプリのAPIキーから同じ接続URIドメイン配下の別アプリを乗っ取れる脆弱性が公表されました。該当構成なら系列ごとの修正版に更新し、APIキーの書き換えがないかも確認します。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
認証サーバーSuperTokens Coreで、1つのアプリのAPIキーから同じ接続URIドメイン配下の別アプリを乗っ取れる脆弱性が公表されました。該当構成なら系列ごとの修正版に更新し、APIキーの書き換えがないかも確認します。
Original description The description as published by the source.
SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, Multitenancy.checkPermissionsForCreateOrUpdate in src/main/java/io/supertokens/multitenancy/Multitenancy.java does not adequately authorize updates to a parent connection URI domain or the base tenant. In a licensed multi-tenant deployment with multiple applications under one non-default connection URI domain and separate api_keys, an attacker holding one application's valid API key can update the parent domain because the CUD-target branch checks the domain without requiring the source application and tenant to be public. Because api_keys is not protected, the attacker can replace the parent key and then sibling application keys, read or modify sibling users, obtain sessions as those users, establish persistence through a sibling dashboard user, and lock out the sibling application's own key. In the advisory's v2 create or update handlers, omitting the optional identifier produces a base-tenant target that skips the permission branches and enterprise-feature gate, allowing changes to firstFactors, required secondary factors, and recipe-enabled flags that affect login integrity and availability. The base-target variant still rejects coreConfig and does not establish key theft. This issue is fixed in versions 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10…
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com