GHSA-j3jp-m26x-5952: 
Rust vulnerability analysis and mitigation

Summary

Token introspection accepted an empty client secret for clients registered without one.

Impact

Affected versions

auth-framework >= 0.5.0-rc18, <= 0.5.0-rc65 and >= 0.6.0-rc41, <= 0.6.0-rc150 (published versions). PATCHED VERSIONS: 0.5.0-rc71 (PR #322) and 0.6.0-rc159 (PR #321). Reasoning: verify_client_credentials (src/api/oauth_advanced.rs) read the stored secret as client_data["client_secret"].as_str().unwrap_or("") and compared the presented secret with it in constant time. A client record with no secret, an empty secret or a non-string secret therefore authenticated with an EMPTY presented secret (Basic client_id: or a POST body with client_secret=), so the introspection endpoint, which RFC 7662 section 2.1 says MUST require authorization, could be called by anyone who knew such a client's client_id (public). Introspection returns the claims and active state of a token the caller names, so the caller needs the token itself: the disclosure is about tokens already held. Clients created through POST /oauth/register (admin or Initial Access Token) always receive a secret and are not affected; the exposure is limited to secret-less clients written into storage by an operator, e.g. public clients. AC:H because of those conditions. Measured set (47 of the 71 published .crate files; the exact line let stored_secret = client_data["client_secret"].as_str().unwrap_or(""); in src/api/oauth_advanced.rs; census 71 of 71; set diffed equal to the plaintext-client-secret set): 0.5.0-rc18, 19, 25, 26, 27, 31, 45, 49, 51, 53, 60, 62, 63, 65; 0.6.0-rc41, 42, 45, 46, 47, 48, 50, 51, 52, 53, 54, 55, 69, 73, 85, 92, 97, 98, 101, 104, 106, 107, 109, 112, 114, 121, 126, 127, 128, 129, 131, 138, 150. Controls: the other 24 tarballs lack the file or the line.

Patches

first published fixed versions 0.5.0-rc71 (PR #322) and 0.6.0-rc159 (PR #321): a client without a secret can no longer authenticate to the introspection endpoint (invalid_client, HTTP 401). Clients with a secret are unaffected. 0.5.0-rc65 and 0.6.0-rc150 are the only live affected versions and are yanked; the other affected versions were yanked earlier. First published fixed versions: 0.5.0-rc71 (tag v0.5.0-rc71) and 0.6.0-rc159 (tag v0.6.0-rc159).

Workarounds

give every client that calls introspection a secret. Credits: none.