[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 28 Jun 2021 09:58:23 +0300 (EEST)
From: Aki Tuomi <aki.tuomi@...ecot.fi>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CVE-2021-29157: Dovecot oauth2 JWT local validation path traversal
Open-Xchange Security Advisory 2021-06-28
Affected product: Dovecot IMAP Server
Vendor: OX Software GmbH
Internal reference: DOP-2159
Vulnerability type: Path Traversal (CWE-24)
Vulnerable version: 2.3.11
Vulnerable component: oauth2
Report confidence: Confirmed
Solution status: Fixed in 2.3.15
Researcher credits: Kirin of Tencent Security Xuanwu Lab.
Vendor notification: 2021-03-22
CVE reference: CVE-2021-29157
CVSS: 6.7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Vulnerability Details:
If attacker can gain access to local filesystem, it is possible to trick Dovecot to use attacker specified key to validate tokens.
Steps to reproduce:
Configure Dovecot to perform OAUTH2 authentication with local JWT validation using posix fs driver.
Place base64 encoded HS256 shared key in a location that is readable by dovecot, and use ../../../../../location/to/path as key azp.
You can now forge tokens and authenticate as any valid user.
Risk:
Attacker can gain access using forged credentials.
Solution:
Upgrade to fixed version.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
