CVE-2023-25558: Deserialization of Untrusted Data (CWE-502)
value: DataHub is an open-source metadata platform. When the DataHub frontend is configured to authenticate via SSO, it will leverage the pac4j library. The processing of the `id_token` is done in an unsafe manner which is not properly accounted for by the DataHub frontend. Specifically, if any of the id_token claims value start with the {#sb64} prefix, pac4j considers the value to be a serialized Java object and will deserialize it. This issue may lead to Remote Code Execution (RCE) in the worst case. Although a `RestrictedObjectInputStream` is in place, that puts some restriction on what classes can be deserialized, it still allows a broad range of java packages and potentially exploitable with different gadget chains. Users are advised to upgrade. There are no known workarounds. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-086.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 8.8
Published: 2023-02-11T01:23Z
Repository: https://github.com/datahub-project/datahub
Language: Java
Files changed: datahub-frontend/app/auth/sso/oidc/custom/CustomOidcAuthenticator.java
Commit date: 2022-12-21 20:11:11 -0600
Commit message: fix(pac4j-oidc): add verifier parameter (#6835)

* fix(pac4j-oidc): add verifier parameter
Diff: diff --git a/datahub-frontend/app/auth/sso/oidc/custom/CustomOidcAuthenticator.java b/datahub-frontend/app/auth/sso/oidc/custom/CustomOidcAuthenticator.java
index fcd916151..8c8c250fb 100644
--- a/datahub-frontend/app/auth/sso/oidc/custom/CustomOidcAuthenticator.java
+++ b/datahub-frontend/app/auth/sso/oidc/custom/CustomOidcAuthenticator.java
@@ -13,10 +13,11 @@ import com.nimbusds.oauth2.sdk.auth.ClientSecretBasic;
 import com.nimbusds.oauth2.sdk.auth.ClientSecretPost;
 import com.nimbusds.oauth2.sdk.auth.Secret;
 import com.nimbusds.oauth2.sdk.http.HTTPRequest;
 import com.nimbusds.oauth2.sdk.http.HTTPResponse;
 import com.nimbusds.oauth2.sdk.id.ClientID;
+import com.nimbusds.oauth2.sdk.pkce.CodeVerifier;
 import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
 import com.nimbusds.openid.connect.sdk.OIDCTokenResponseParser;
 import com.nimbusds.openid.connect.sdk.token.OIDCTokens;
 import java.io.IOException;
 import java.net.URI;
@@ -142,12 +143,14 @@ public class CustomOidcAuthenticator implements Authenticator<OidcCredentials> {
     final AuthorizationCode code = credentials.getCode();
     // if we have a code
     if (code != null) {
       try {
         final String computedCallbackUrl = client.computeFinalCallbackUrl(context);
+        CodeVerifier verifier = (CodeVerifier) configuration.getValueRetriever()
+                .retrieve(client.getCodeVerifierSessionAttributeName(), client, context).orElse(null);
         // Token request
-        final TokenRequest request = createTokenRequest(new AuthorizationCodeGrant(code, new URI(computedCallbackUrl)));
+        final TokenRequest request = createTokenRequest(new AuthorizationCodeGrant(code, new URI(computedCallbackUrl), verifier));
         HTTPRequest tokenHttpRequest = request.toHTTPRequest();
         tokenHttpRequest.setConnectTimeout(configuration.getConnectTimeout());
         tokenHttpRequest.setReadTimeout(configuration.getReadTimeout());
 
         final HTTPResponse httpResponse = tokenHttpRequest.send();

Vulnerable code:         final TokenRequest request = createTokenRequest(new AuthorizationCodeGrant(code, new URI(computedCallbackUrl)));
Fixed code: import com.nimbusds.oauth2.sdk.pkce.CodeVerifier;
        CodeVerifier verifier = (CodeVerifier) configuration.getValueRetriever()
                .retrieve(client.getCodeVerifierSessionAttributeName(), client, context).orElse(null);
        final TokenRequest request = createTokenRequest(new AuthorizationCodeGrant(code, new URI(computedCallbackUrl), verifier));