CVE-2022-39222: Github.com/dexidp/dex Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vh7g-p26c-j2cw",
  "modified" : "2023-07-12T14:01:57Z",
  "published" : "2022-10-03T19:12:03Z",
  "aliases" : [ "CVE-2022-39222" ],
  "summary" : "Dex vulnerable to Man-in-the-Middle allowing ID token capture via intercepted authorization code",
  "details" : "### Impact\nDex instances with public clients (and by extension, clients accepting tokens issued by those Dex instances) are affected by this vulnerability.\n\nAn attacker can exploit this vulnerability by making a victim navigate to a malicious website and guiding them through the OIDC flow, stealing the OAuth authorization code in the process. The authorization code then can be exchanged by the attacker for a token, gaining access to applications accepting that token.\n\n### Steps to reproduce\n\n1) A victim navigates to a malicious website\n\n2) The webserver initiates a connection with a Dex instance directly - https://dexexample.com/auth/https:%252F%252Faccounts.google.com?access_type=online&client_id=example&nonce=2AaJAimQU9CbeOFsNra1d7CJTWB&redirect_uri=http%3A%2F%2Flocalhost%3A40393%2Fauth%2Fcallback&response_type=code&scope=openid+email&state=2AaJAjhpUmsB25csCo5muvorMTl. In this example, the Dex instance is hosted on `dexexample.com`, and the connector is `accounts.google.com`.\n\n3) Dex returns a 302 Redirect to the connector IDP, https://accounts.google.com/o/oauth2/v2/auth?client_id=237800849078-hri2ndt7gdafpf34kq8crd5sik9pe3so.apps.googleusercontent.com&redirect_uri=https%3A%2F%2Fdexexample.com%2Fauth%2Fcallback&response_type=code&scope=openid+email&state=g3dkmpontsr3ugocoddjx72ef. The attacker records the state parameter value g3dkmpontsr3ugocoddjx72ef which will be used as the request ID later on.\n\n4) The malicious website redirects the victim’s browser to the connector IDP.\n\n5) The user authenticates to the connector IDP. If they have authenticated before, they may not be presented with an authentication challenge. The user will silently be taken through the following steps:\n\n    Authentication with the connector IDP, which redirects the browser to the Dex callback with a code - https://dexexample.com/callback?state=g3dkmpontsr3ugocoddjx72ef&code=4%2F0AX4XfWizg1PQEQNl18hmP0_YQ3iUYII2ed13n9ikKr_ZcV7uCZpZaPcIlxBzX5QwFIcs-w&scope=email+openid+https%3A%2F%[2Fwww.googleapis.com](http://2fwww.googleapis.com/)%2Fauth%2Fuserinfo.email&authuser=0&hd=[google.com](http://google.com/)&prompt=none\n\n    Dex handles the callback, fetching the user claims from the connector IDP, persisting them and generating an OAuth code. Then Dex redirects the browser to the approval endpoint https://dexexample.com/approval?req=g3dkmpontsr3ugocoddjx72ef. Note that the req parameter is the same as the attacker's recorded state parameter.\n\n    Dex uses the request ID to look up the OAuth code, and builds a redirect to the original callback with the code - http://localhost:40393/auth/callback?code=bz5p3oov2wlh5k3rboa4atxas&state=2AaJAjhpUmsB25csCo5muvorMTl.\n\n\nIn step 2., when the webserver initiates the connection to Dex and receives the redirect to the connector IDP, the webserver will persist the connector state parameter (`g3dkmpontsr3ugocoddjx72ef`), which is used as the request ID to later look up the OAuth code. As the user goes through the authentication flow with the connector IDP, the webserver will repeatedly request `/approval?req=<state>`. Once the user has successfully authenticated, if the webserver is able to call /approval before the victim’s browser calls `/approval`, then an attacker can fetch the Dex OAuth code which can be exchanged for an ID token using the `/token` endpoint.\n\nNote that PKCE does not defend against this attack since the webserver initiates the request to Dex with a known code challenge.\n\n### Fix\n\nThe request has been made unpredictable with message authentication. This was accomplished by creating an [HMAC](https://en.wikipedia.org/wiki/HMAC) using a randomly generated per-request secret. This secret is persisted between the initial login request and the approval request. Since the HMAC is derived using a secret key, its value cannot be known to an attacker, so they will be unable to poll `/approval` for the code.\n\n### Patches\nUpdate to 2.35.0.\n\n### Workarounds\nNo known workarounds (without impacting behavior) for existing versions.\n\nDisabling public clients is the only way to defend against attacks exploiting this vulnerability.\n\n### References\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Start a new [discussion](https://github.com/dexidp/dex/discussions/new?category=q-a)\n* Email us at [cncf-dex-maintainers@lists.cncf.io](mailto:cncf-dex-maintainers@lists.cncf.io)\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/dexidp/dex"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.35.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.34.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/dexidp/dex/security/advisories/GHSA-vh7g-p26c-j2cw"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-39222"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/dexidp/dex/commit/49471b14c8080ddb034d4855841123d378b7a634"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/dexidp/dex"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/dexidp/dex/releases/tag/v2.35.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200", "CWE-862" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-10-03T19:12:03Z",
    "nvd_published_at" : "2022-10-06T18:16:00Z"
  }
}