Implementation trusts the "me" field returned by the authorization server without verifying it

published 2020-11-24 5y ago modified 2022-03-21 4y ago

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Impact

A malicious user can sign in as a user with any IndieAuth identifier. This is because the implementation does not verify that the final `"me"` URL value returned by the authorization server belongs to the same domain as the initial value entered by the user.

### Patches

Version 1.1 fixes this issue.

### Workarounds

There is no workaround. Upgrade to 1.1 immediately.

### References

- [Security Considerations: Differing User Profile URLs](https://indieauth.spec.indieweb.org/#differing-user-profile-urls-li-1) in the IndieAuth specification.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [simonw/datasette-indieauth](https://github.com/simonw/datasette-indieauth/issues)

Patch / fix

fixed in 1 links 1

pypi datasette-indieauth 1.1

github.com/simonw/datasette-indieauth@376c880 commit

Is GHSA-mjcr-rqjg-rhg3 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
pypi	datasette-indieauth	>=1.0, <1.1	1.1

Classification

Weakness

CWE-290 Authentication Bypass by Spoofing

References

Sources

GitHub Advisory GHSA-mjcr-rqjg-rhg3

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.