- Reported
-
- Issued
-
- Package
-
azure_security_keyvault_secrets
(crates.io)
- Type
-
Vulnerability
- Keywords
-
#keyvault
#authentication
#challenge
#cache
- References
-
- Patched
-
- Unaffected
-
Description
Affected versions of KeyVaultAuthorizer::on_challenge cache the authentication
scope from a WWW-Authenticate response before verifying that the challenge
resource matches the requested endpoint. When verification rejects the challenge,
the scope remains cached. A subsequent request through the same client uses that
scope to authorize the request without repeating challenge resource verification.
For azure_security_keyvault_secrets, the affected versions are 0.10.0 through
1.0.0, inclusive. Versions before 0.10.0 do not use this challenge-scope cache
and are unaffected by this issue. The published 1.1.0-beta.1 already includes
the fix.
Impact
An application that sends requests to an attacker-controlled endpoint and reuses
the same client after a rejected challenge can disclose a bearer token and request
body to that endpoint, if its credential can obtain a token for the supplied scope.
The first request's validation error therefore does not prevent disclosure on a
later request. Changing the request origin between requests is not required.
Fix
Update to 1.0.1 on the stable release line or 1.1.0-beta.1 on the preview
release line.
The fix caches the scope only after challenge resource verification succeeds
when verification is enabled. Rejected challenges no longer populate the cache.
The existing option to disable challenge resource verification is unchanged;
this fix does not add exact-origin binding.
Advisory available under CC0-1.0
license.