discourse-microsoft-auth microsoft_auth:revoke authorization

Summaryinfo

A vulnerability marked as critical has been reported in discourse-microsoft-auth. Affected by this vulnerability is the function microsoft_auth:revoke. This manipulation causes authorization. The identification of this vulnerability is CVE-2023-46241. It is possible to initiate the attack remotely. There is no exploit available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability was found in discourse-microsoft-auth (the affected version is unknown). It has been declared as critical. Affected by this vulnerability is the function microsoft_auth:revoke. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

`discourse-microsoft-auth` is a plugin that enables authentication via Microsoft. On sites with the `discourse-microsoft-auth` plugin enabled, an attack can potentially take control of a victim's Discourse account. Sites that have configured their application's account type to any options other than `Accounts in this organizational directory only (O365 only - Single tenant)` are vulnerable. This vulnerability has been patched in commit c40665f44509724b64938c85def9fb2e79f62ec8 of `discourse-microsoft-auth`. A `microsoft_auth:revoke` rake task has also been added which will deactivate and log out all users that have connected their accounts to Microsoft. User API keys as well as API keys created by those users will also be revoked. The rake task will also remove the connection records to Microsoft for those users. This will allow affected users to re-verify their account emails as well as reconnect their Discourse account to Microsoft for authentication. As a workaround, disable the `discourse-microsoft-auth` plugin by setting the `microsoft_auth_enabled` site setting to `false`. Run the `microsoft_auth:log_out_users` rake task to log out all users with associated Microsoft accounts.

The weakness was shared 02/21/2024 as GHSA-2w32-w539-3m7r. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2023-46241 since 10/19/2023. Technical details of the vulnerability are known, but there is no available exploit.

Applying the patch c40665f44509724b64938c85def9fb2e79f62ec8 is able to eliminate this problem. The bugfix is ready for download at github.com.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Chat Software

Name

• discourse-microsoft-auth

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion