GitStock

duendesoftware/duende.accesstokenmanagement · Security

HTTP Client uses incorrect token after refresh

GHSA ID
GHSA-7mr7-4f54-vcx5
CVE ID
CVE-2024-51987
Severity
medium
Published
Updated
CVSS
5.4 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v3
5.4 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Description

Impact

HTTP Clients created by AddUserAccessTokenHttpClient may use a different user's access token after a token refresh. This occurs because a refreshed token will be captured in pooled HttpClient instances, which may be used by a different user.

Workarounds

Instead of using AddUserAccessTokenHttpClient to create an HttpClient that automatically adds a managed token to outgoing requests, you can use the HttpConext.GetUserAccessTokenAsync extension method or the IUserTokenManagementService.GetAccessTokenAsync method.

Patches

This issue is fixed in Duende.AccessTokenManagement.OpenIdConnect 3.0.1.

CWEs

  • CWE-270 · Privilege Context Switching Error

References

Open GitHub