GHSA-qxx8-292g-2w66: Microsoft.Bot.Connector Improper Authentication Vulnerability
HIGHGHSA-qxx8-292g-2w66 is a HIGH improper authentication vulnerability (CWE-287: Improper Authentication) affecting Microsoft.Bot.Connector libraries in the NuGet ecosystem. The issue involves improper authentication. Remediation is available by upgrading affected packages to version 4.6.4, 4.7.3, 4.8.2, 4.9.5, 4.10.3.
GHSA-qxx8-292g-2w66 at a Glance
How to Fix GHSA-qxx8-292g-2w66
To remediate this vulnerability, upgrade all affected Microsoft.Bot.Connector dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade Microsoft.Bot.Connector to 4.6.4Upgrade Microsoft.Bot.Connector to 4.7.3Upgrade Microsoft.Bot.Connector to 4.8.2Upgrade Microsoft.Bot.Connector to 4.9.5Upgrade Microsoft.Bot.Connector to 4.10.3Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for Microsoft.Bot.ConnectorHow to Check if You Are Affected
To determine whether your application is affected by GHSA-qxx8-292g-2w66, inspect your project dependencies for Microsoft.Bot.Connector:
inspect dependencies for Microsoft.Bot.ConnectorAnalyze the terminal output to locate any version of Microsoft.Bot.Connector in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.6.4), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-287: Improper Authentication, where when an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. In Microsoft.Bot.Connector, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-qxx8-292g-2w66 Affected Microsoft.Bot.Connector Versions
5 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
Microsoft.Bot.Connector
|
NuGet |
≥ 4.6.0
< 4.6.4
|
4.6.4
|
|
Microsoft.Bot.Connector
|
NuGet |
≥ 4.7.0
< 4.7.3
|
4.7.3
|
|
Microsoft.Bot.Connector
|
NuGet |
≥ 4.8.0
< 4.8.2
|
4.8.2
|
|
Microsoft.Bot.Connector
|
NuGet |
≥ 4.9.0
< 4.9.5
|
4.9.5
|
|
Microsoft.Bot.Connector
|
NuGet |
≥ 4.10.0
< 4.10.3
|
4.10.3
|
References
Frequently Asked Questions
What is GHSA-qxx8-292g-2w66?
Which Microsoft.Bot.Connector versions are affected?
What version fixes GHSA-qxx8-292g-2w66?
Is Microsoft.Bot.Connector affected?
What CWE is associated with GHSA-qxx8-292g-2w66?
How can I check NuGet dependencies for GHSA-qxx8-292g-2w66?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-qxx8-292g-2w66",
"modified" : "2021-03-08T15:48:36Z",
"published" : "2021-03-08T15:50:01Z",
"aliases" : [ ],
"summary" : "Improper Authentication",
"details" : "### Impact\nA maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an an attacker to have internal knowledge of the bot.\n\n### Patches\nThe problem has been patched in all affected versions. Please see the list of patched versions for the most appropriate one for your individual case.\n\n### Workarounds\nUsers who do not wish or are not able to upgrade can add an authentication configuration containing ClaimsValidator which throws an exception if the Claims are Skill Claims.\n\nFor detailed instructions, see the link in the References section.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Microsoft Bot Builder SDK](https://github.com/microsoft/botbuilder-dotnet)\n* Email us at [bf-reports@microsoft.com](mailto:bf-reports@microsoft.com)",
"severity" : [ ],
"affected" : [ {
"package" : {
"ecosystem" : "NuGet",
"name" : "Microsoft.Bot.Connector"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.6.0"
}, {
"fixed" : "4.6.4"
} ]
} ]
}, {
"package" : {
"ecosystem" : "NuGet",
"name" : "Microsoft.Bot.Connector"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.7.0"
}, {
"fixed" : "4.7.3"
} ]
} ]
}, {
"package" : {
"ecosystem" : "NuGet",
"name" : "Microsoft.Bot.Connector"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.8.0"
}, {
"fixed" : "4.8.2"
} ]
} ]
}, {
"package" : {
"ecosystem" : "NuGet",
"name" : "Microsoft.Bot.Connector"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.9.0"
}, {
"fixed" : "4.9.5"
} ]
} ]
}, {
"package" : {
"ecosystem" : "NuGet",
"name" : "Microsoft.Bot.Connector"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.10.0"
}, {
"fixed" : "4.10.3"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/microsoft/botbuilder-dotnet/security/advisories/GHSA-qxx8-292g-2w66"
}, {
"type" : "WEB",
"url" : "https://aka.ms/SkillClaimsValidationDotnet"
}, {
"type" : "WEB",
"url" : "https://www.nuget.org/packages/Microsoft.Bot.Connector"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-287" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2021-03-08T15:48:36Z",
"nvd_published_at" : null
}
}