Vulnerability: scheme/webauthn.c in Glewlwyd SSO server 2.x before 2.6.2 has a buffer overflow associated with a webauthn assertion.
Vulnerability ID: CVE-2022-27240
CWE: CWE-120
Severity score: 6.4
Project: https://github.com/babelouest/glewlwyd
Published: 2022-03-18
File: src/scheme/webauthn.c
Commit message: Fix possible buffer overflow
Commit author: babelouest

Vulnerable version (before fix):
 static int check_assertion(struct config_module * config, json_t * j_params, con         break;       }        if (!o_base64url_decode((const unsigned char *)json_string_value(json_object_get(json_object_get(json_object_get(j_scheme_data, "credential"), "response"), "signature")), json_string_length(json_object_get(json_object_get(json_object_get(j_scheme_data, "credential"), "response"), "signature")), sig, &sig_len)) {         y_log_message(Y_LOG_LEVEL_DEBUG, "check_assertion - Error o_base64url_decode signature");         ret = G_ERROR_PARAM;         break;       }        memcpy(data_signed, auth_data, auth_data_len);       memcpy(data_signed+auth_data_len, cdata_hash, cdata_hash_len);

Fixed version (after fix):
 static int check_assertion(struct config_module * config, json_t * j_params, con         break;       }        if (!o_base64_decode((const unsigned char *)json_string_value(json_object_get(json_object_get(json_object_get(j_scheme_data, "credential"), "response"), "signature")), json_string_length(json_object_get(json_object_get(json_object_get(j_scheme_data, "credential"), "response"), "signature")), NULL, &sig_len)) {         y_log_message(Y_LOG_LEVEL_DEBUG, "check_assertion - Invalid signature format");         ret = G_ERROR_PARAM;         break;       }              if (sig_len > 128) {         y_log_message(Y_LOG_LEVEL_DEBUG, "check_assertion - Invalid signature");         ret = G_ERROR_PARAM;         break;       }        if (!o_base64_decode((const unsigned char *)json_string_value(json_object_get(json_object_get(json_object_get(j_scheme_data, "credential"), "response"), "signature")), json_string_length(json_object_get(json_object_get(json_object_get(j_scheme_data, "credential"), "response"), "signature")), sig, &sig_len)) {         y_log_message(Y_LOG_LEVEL_DEBUG, "check_assertion - Error o_base64_decode signature");         ret = G_ERROR;         break;       }        memcpy(data_signed, auth_data, auth_data_len);       memcpy(data_signed+auth_data_len, cdata_hash, cdata_hash_len);

Patch:
patch: @@ -2636,11 +2636,23 @@ static int check_assertion(struct config_module * config, json_t * j_params, con
         break;
       }
 
-      if (!o_base64url_decode((const unsigned char *)json_string_value(json_object_get(json_object_get(json_object_get(j_scheme_data, "credential"), "response"), "signature")), json_string_length(json_object_get(json_object_get(json_object_get(j_scheme_data, "credential"), "response"), "signature")), sig, &sig_len)) {
-        y_log_message(Y_LOG_LEVEL_DEBUG, "check_assertion - Error o_base64url_decode signature");
+      if (!o_base64_decode((const unsigned char *)json_string_value(json_object_get(json_object_get(json_object_get(j_scheme_data, "credential"), "response"), "signature")), json_string_length(json_object_get(json_object_get(json_object_get(j_scheme_data, "credential"), "response"), "signature")), NULL, &sig_len)) {
+        y_log_message(Y_LOG_LEVEL_DEBUG, "check_assertion - Invalid signature format");
         ret = G_ERROR_PARAM;
         break;
       }
+      
+      if (sig_len > 128) {
+        y_log_message(Y_LOG_LEVEL_DEBUG, "check_assertion - Invalid signature");
+        ret = G_ERROR_PARAM;
+        break;
+      }
+
+      if (!o_base64_decode((const unsigned char *)json_string_value(json_object_get(json_object_get(json_object_get(j_scheme_data, "credential"), "response"), "signature")), json_string_length(json_object_get(json_object_get(json_object_get(j_scheme_data, "credential"), "response"), "signature")), sig, &sig_len)) {
+        y_log_message(Y_LOG_LEVEL_DEBUG, "check_assertion - Error o_base64_decode signature");
+        ret = G_ERROR;
+        break;
+      }
 
       memcpy(data_signed, auth_data, auth_data_len);
       memcpy(data_signed+auth_data_len, cdata_hash, cdata_hash_len);
path: src/scheme/webauthn.c