Vulnerabilities in pkg:nuget/Microsoft.IdentityModel.Protocols.SignedHttpRequest

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rv9j-c866-gp5h",
  "modified" : "2024-01-10T15:13:42Z",
  "published" : "2024-01-09T18:25:47Z",
  "aliases" : [ "CVE-2024-21643" ],
  "summary" : "Microsoft.IdentityModel.Protocols.SignedHttpRequest remote code execution vulnerability",
  "details" : "### Impact\n_What kind of vulnerability is it? Who is impacted?_\nAnyone leveraging the `SignedHttpRequest`protocol or the `SignedHttpRequestValidator`is vulnerable. Microsoft.IdentityModel trusts the `jku`claim by default for the `SignedHttpRequest`protocol. This raises the possibility to make any remote or local `HTTP GET` request. \n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\nThe vulnerability has been fixed in Microsoft.IdentityModel.Protocols.SignedHttpRequest. Users **should** update **all** their Microsoft.IdentityModel versions to 7.1.2 (for 7x) or higher, 6.34.0 (for 6x) or higher, if using Microsoft.IdentityModel.Protocols.SignedHttpRequest.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\nNo, users must upgrade.\n\n### References\n_Are there any links users can visit to find out more?_\nhttps://aka.ms/IdentityModel/Jan2024/jku",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "NuGet",
      "name" : "Microsoft.IdentityModel.Protocols.SignedHttpRequest"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "6.34.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "NuGet",
      "name" : "Microsoft.IdentityModel.Protocols.SignedHttpRequest"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "7.0.0-preview"
      }, {
        "fixed" : "7.1.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-rv9j-c866-gp5h"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-21643"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/6.34.0"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/7.1.2"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/wiki/jkucve"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-94" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-01-09T18:25:47Z",
    "nvd_published_at" : "2024-01-10T05:15:09Z"
  }
}