CVE-2023-50708 (published 2023-12-22T19:15Z)

yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is compared via regular string comparison (instead of `Yii::$app->getSecurity()->compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are available.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/yiisoft/yii2-authclient
commit_details: repo_url: https://github.com/yiisoft/yii2-authclient
author: rhertogh
author_date: 2023-12-16 16:11:39+01:00
msg: Merge pull request from GHSA-w8vh-p74j-x9xp

* Fixed Oauth1/2 and OpenID Connect state/noce check

* Updated changelog for ghsa-w8vh-p74j-x9xp

---------

Co-authored-by: Alexander Makarov <sam@rmcreative.ru>
repository: repo_url: https://github.com/yiisoft/yii2-authclient
repo_name: yiisoft/yii2-authclient
description: Yii 2 authclient extension.
repo_language: PHP
owner: yiisoft
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -6,6 +6,7 @@ Yii Framework 2 authclient extension Change Log
 
 - Bug #364: Use issuer claim from OpenID Configuration (radwouters)
 - Enh #367: Throw more specific `ClientErrorResponseException` when the response code in `BaseOAuth::sendRequest()` is a 4xx (rhertogh)
+- Enh GHSA-w8vh-p74j-x9xp: Improved security for OAuth1, OAuth2 and OpenID Connect clients by using timing attack safe string comparsion (rhertogh)
 - Enh GHSA-rw54-6826-c8j5: Improved security for OAuth2 client by requiring an `authCodeVerifier` if PKCE is enabled and clearing it after usage (rhertogh)
 
 

programming_language: Markdown
filename: OAuth1.php
change_type: ModificationType.MODIFY
diff: @@ -155,7 +155,7 @@ abstract class OAuth1 extends BaseOAuth
             }
         }
 
-        if (strcmp($requestToken->getToken(), $oauthToken) !== 0) {
+        if (!Yii::$app->getSecurity()->compareString($requestToken->getToken(), $oauthToken)) {
             throw new HttpException(400, 'Invalid auth state parameter.');
         }
 

programming_language: PHP
filename: OAuth2.php
change_type: ModificationType.MODIFY
diff: @@ -118,7 +118,11 @@ abstract class OAuth2 extends BaseOAuth
             $authState = $this->getState('authState');
             $incomingRequest = Yii::$app->getRequest();
             $incomingState = $incomingRequest->get('state', $incomingRequest->post('state'));
-            if (!isset($incomingState) || empty($authState) || strcmp($incomingState, $authState) !== 0) {
+            if (
+                !isset($incomingState)
+                || empty($authState)
+                || !Yii::$app->getSecurity()->compareString($incomingState, $authState)
+            ) {
                 throw new HttpException(400, 'Invalid auth state parameter.');
             }
             $this->removeState('authState');

programming_language: PHP
filename: OpenIdConnect.php
change_type: ModificationType.MODIFY
diff: @@ -417,7 +417,11 @@ class OpenIdConnect extends OAuth2
 
             if ($this->getValidateAuthNonce()) {
                 $authNonce = $this->getState('authNonce');
-                if (!isset($jwsData['nonce']) || empty($authNonce) || strcmp($jwsData['nonce'], $authNonce) !== 0) {
+                if (
+                    !isset($jwsData['nonce'])
+                    || empty($authNonce)
+                    || !Yii::$app->getSecurity()->compareString($jwsData['nonce'], $authNonce)
+                ) {
                     throw new HttpException(400, 'Invalid auth nonce');
                 } else {
                     $this->removeState('authNonce');

programming_language: PHP