CVE-2020-10187: 
Ruby vulnerability analysis and mitigation

Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability (CVE-2020-10187) that allows an attacker to retrieve OAuth application client secrets that should only be accessible to the application owner. The vulnerability was discovered in early 2020 and affects all versions from 5.0.0 until it was patched in versions 5.0.3, 5.1.1, 5.2.5, and 5.3.2 (GitHub Advisory).

The vulnerability exists in the application's JSON response handling where an attacker can access sensitive information by requesting the list of their authorized applications in JSON format (typically via GET /oauth/authorized_applications.json). The vulnerability received a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact with network accessibility (NVD).

The vulnerability allows unauthorized access to client secrets of OAuth applications, which could potentially be used to impersonate legitimate applications or gain unauthorized access to protected resources. This exposure is particularly critical for applications that rely on client secrets for authentication (GitHub Advisory).

The vulnerability is easily exploitable and requires only that an attacker has authorization to an application. After authorization, the attacker simply needs to make a GET request to the authorized applications endpoint in JSON format to retrieve sensitive information including client secrets (NVD).

The vulnerability has been patched in versions 5.0.3, 5.1.1, 5.2.5, and 5.3.2. Organizations should upgrade to these or later versions immediately. As a workaround, administrators can patch the Doorkeeper::Application model's #as_json method to explicitly define exposed attributes. Additional hardening can be achieved by enabling application secrets hashing, a feature available since Doorkeeper 5.1, which renders exposed secrets unusable (GitHub Advisory).

The vulnerability was responsibly reported by security researcher Stefan Sundin and was quickly addressed by the Doorkeeper team. The fix was implemented through a comprehensive patch that restricts serialized attributes to a minimal set of columns (GitLab Release).