Listen to this Post
How the mentioned CVE works:
This vulnerability is an authentication bypass in the Drupal Simple OAuth & OpenID Connect module. The flaw exists in the token validation logic for OAuth2 bearer tokens. Specifically, the module incorrectly handles tokens signed with the ‘none’ algorithm. A remote attacker can forge a malicious JWT token specifying the ‘none’ algorithm, indicating no signature is required. The module’s token parser improperly validates this token, accepting it as legitimate without performing any cryptographic signature verification. Consequently, the attacker can create a token with arbitrary claims, including an administrator-level user, and gain unauthorized access to the application. This allows a complete bypass of the OAuth2 authentication mechanism.
Platform: Drupal
Version: 6.0.0-6.0.6
Vulnerability : Authentication Bypass
Severity: Critical
date: 2024-10-30
Prediction: 2024-11-13
What Undercode Say:
curl -H "Authorization: Bearer <malicious_jwt>" http://target/drupal/oauth-api
import jwt
malicious_token = jwt.encode({"user": "admin"}, algorithm="none", key="")
print(malicious_token)
How Exploit:
Craft JWT with ‘none’ algorithm.
Set token claims to admin.
Use token in Authorization header.
Bypass login mechanisms.
Access privileged endpoints.
Protection from this CVE:
Upgrade to version 6.0.7.
Disable the module.
Implement WAF rules.
Reject ‘none’ algorithm tokens.
Validate token signatures strictly.
Impact:
Full site compromise.
Admin privilege escalation.
Data theft.
Unauthorized access.
Bypass all authentication.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
