GHSA-j7vx-8mqj-cqp9

Suggest an improvement
Source
https://github.com/advisories/GHSA-j7vx-8mqj-cqp9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/05/GHSA-j7vx-8mqj-cqp9/GHSA-j7vx-8mqj-cqp9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-j7vx-8mqj-cqp9
Aliases
Published
2020-05-07T21:11:07Z
Modified
2023-11-08T04:01:57.491826Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper
Details

Impact

Information disclosure vulnerability. Allows an attacker to see all Doorkeeper::Application model attribute values (including secrets) using authorized applications controller if it's enabled (GET /oauth/authorized_applications.json).

Patches

These versions have the fix:

  • 5.0.3
  • 5.1.1
  • 5.2.5
  • 5.3.2

Workarounds

Patch Doorkeeper::Application model #as_json(options = {}) method and define only those attributes you want to expose.

Additional recommended hardening is to enable application secrets hashing (guide), available since Doorkeeper 5.1. This would render the exposed secret useless.

References

  • Commit with fix: https://github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10187
Database specific 
{
    "nvd_published_at": "2020-05-04T14:15:00Z",
    "github_reviewed_at": "2020-05-07T21:09:24Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-862"
    ]
}
References

Affected packages

RubyGems / doorkeeper

Package

Name
doorkeeper
Purl
pkg:gem/doorkeeper

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.0.0
Fixed
5.0.3

Affected versions

5.*

5.0.0
5.0.1
5.0.2

RubyGems / doorkeeper

Package

Name
doorkeeper
Purl
pkg:gem/doorkeeper

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.1.0
Fixed
5.1.1

Affected versions

5.*

5.1.0

RubyGems / doorkeeper

Package

Name
doorkeeper
Purl
pkg:gem/doorkeeper

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.2.0
Fixed
5.2.5

Affected versions

5.*

5.2.0
5.2.1
5.2.2
5.2.3
5.2.4

RubyGems / doorkeeper

Package

Name
doorkeeper
Purl
pkg:gem/doorkeeper

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.3.0
Fixed
5.3.2

Affected versions

5.*

5.3.0
5.3.1