Unratedcrates.ioPublished
Rejected authentication challenges can poison the Key Vault scope cache
- Affected
- crates.io azure_security_keyvault_certificates >= 0.9.0, < 1.0.1; >= 1.1.0-beta.0, < 1.1.0-beta.2
- Fixed in
- 1.1.0-beta.21.0.1· Vendor fix available
- Issue
- Affected versions of `KeyVaultAuthorizer::on_challenge` cache the authentication scope from a `WWW-Authenticate` response before verifying that the challenge resource matches the requested endpoint. When verification rejects the challenge, the scope remains cached. A subsequent request through the same client uses that scope to authorize the request without repeating challenge resource verification. For `azure_security_keyvault_certificates`, the affected versions are `0.9.0` through `1.0.0`, inclusive, and `1.1.0-beta.1`. Versions before `0.9.0` do not use this challenge-scope cache and are unaffected by this issue. Impact An application that sends requests to an attacker-controlled endpoint and reuses the same client after a rejected challenge can disclose a bearer token and request body to that endpoint, if its credential can obtain a token for the supplied scope. The first request's validation error therefore does not prevent disclosure on a later request. Changing the request…
Recommended action: Upgrade to 1.1.0-beta.2 (pre-release) or 1.0.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.