GitHub Security Advisory: GHSA-22w3-693w-x895
Package: webauthn-authenticator-rs (RUST)
Severity: LOW (CVSS 0.0)
CWE: CWE-1289: Improper Validation of Unsafe Equivalence in Input
Vulnerable versions: = 0.6.0-dev
Patched in: 0.6.1-dev

Summary: webauthn-rs-core/webauthn-authenticator-rs: Origin validation mismatch possible when subdomains are allowed

Details:
### Summary

`webauthn-rs-core` ([Relying Party][rp]) and `webauthn-authenticator-rs` ([client][]) checked that [an `Origin` in `CollectedClientData`][origin] is valid for [an RP ID][rpid] with [`str::ends_with()`][ends-with], [without checking for a dot (`.`) before the RP ID when allowing subdomains][registerable-suffix].

This check is flawed, and could allow requests from an attacker-controlled domain such as `hermit-crab.example` to be accepted for the RP ID `crab.example` (assuming `.example` was publicly-registerable TLD) when the RP allows authenticating from a subdomain (disabled by default in `webauthn-rs-core` and `webauthn-rs`).

[registerable-suffix]: https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to
[ends-with]: https://doc.rust-lang.org/stable/std/primitive.str.html#method.ends_with
[client]: https://www.w3.org/TR/webauthn-3/#client
[rp]: https://www.w3.org/TR/webauthn-3/#relying-party
[rpid]: https://www.w3.org/TR/webauthn-3/#rp-id
[origin]: https://www.w3.org/TR/webauthn-3/#dom-collectedclientdata-origin

* In `webauthn-rs-core`, this **only** applies when:
  * [`WebauthnCore::allow_subdomains_origin`](https://docs.rs/webauthn-rs-core/0.5.4/webauthn_rs_core/struct.WebauthnCore.html#method.new_unsafe_experts_only) is `true` (the default is `false`), *and*
  * the attacker could register a domain that ends with the RP ID as a raw string, *and*,
  * the client does not implement these checks correctly either

  `webauthn-rs` can set `allow_subdomains_origin` via [`WebauthnBuilder::allow_subdomains`](https://docs.rs/webauthn-rs/0.5.4/webauthn_rs/struct.WebauthnBuilder.html#method.allow_subdomains). Fixing the bug in `webauthn-rs-core` also fixes it in `webauthn-rs`.

* In `webauthn-authenticator-rs`, the flawed check is in [`WebauthnAuthenticator::do_registration()`](https://docs.rs/webauthn-authenticator-rs/0.5.4/webauthn_authenticator_rs/struct.WebauthnAuthenticator.html#method.do_registration) and [`do_authentication()`](https://docs.rs/webauthn-authenticator-rs/0.5.4/webauthn_authenticator_rs/struct.WebauthnAuthenticator.html#method.do_registration). 

  A conforming [Relying Party][rp] implementation would reject such requests, but `webauthn-rs-core` did not.

  An application can still provide an incorrect `origin` parameter to `webauthn-authenticator-rs`, or use lower-level APIs that bypass these checks entirely, and this is by design.

These issues are a violation of [WebAuthn Level 3 §13.4.9](https://www.w3.org/TR/webauthn-3/#sctn-validating-origin), [§5.1.3 Step 8](https://www.w3.org/TR/webauthn-3/#CreateCred-DetermineRpId) and [§5.1.4.1 Step 7](https://www.w3.org/TR/webauthn-3/#GetAssn-DetermineRpId).

### Details

* `webauthn-rs-core/src/core.rs` line 1213:

  https://github.com/kanidm/webauthn-rs/blob/197cddf8487a2dbdd5d374e50d80aa1e4682f3ab/webauthn-rs-core/src/core.rs#L1211-L1216

* `webauthn-authenticator-rs/src/lib.rs` line 274:

  https://github.com/kanidm/webauthn