riganti/dotvvm · Security
DotVVM: Missing authorization in AuthorizeActionFilter
- GHSA ID
- GHSA-c8qj-jx8j-fg2w
- Severity
- critical
- Published
- Updated
- CVSS v4
- 9.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
Impact
All users of the AuthorizeActionFilter class are affected. The AuthorizeActionFilter simply does nothing, no “hacking” is needed to bypass the filter.
Patches
DotVVM 4.3.15, 4.2.11 and 5.0.0-preview09 fix this.
Workarounds
As a workaround, you can use the AuthorizeAttribute instead. It implements the same interfaces (correctly). Note that is it deprecated for unrelated reasons, feel free to suppress the warning when using it as action filter.
CWEs
- CWE-862 · Missing Authorization