Low, CVSS 2.3crates.ioPublished
webauthn-rs-core/webauthn-authenticator-rs: Origin validation mismatch possible when subdomains are allowed
GHSA-22w3-693w-x895
- Affected
- crates.io webauthn-authenticator-rs >= 0.6.0-dev, <= 0.6.0-dev; <= 0.5.4
- Fixed in
- 0.6.1-dev0.5.5· Vendor fix available
- Issue
- webauthn-rs-core ([Relying Party][rp]) and webauthn-authenticator-rs ([client][]) checked that [an Origin in CollectedClientData][origin] is valid for [an RP ID][rpid] with [str::endswith()][ends-with], [without checking for a dot (.) before the RP ID when allowing subdomains][registerable-suffix]. This check is flawed, and could allow requests from an attacker-controlled domain such as hermit-crab.example to be accepted for the RP ID crab.example (assuming .example was publicly-registerable TLD) when the RP allows authenticating from a subdomain (disabled by default in webauthn-rs-core and webauthn-rs). [registerable-suffix]: https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to [ends-with]: https://doc.rust-lang.org/stable/std/primitive.str.html#method.endswith [client]: https://www.w3.org/TR/webauthn-3/#client [rp]: https://www.w3.org/TR/webauthn-3/#relying-party [rpid]: https://www.w3.org/TR/webauthn-3/#rp-id [origin]:…
Recommended action: Upgrade to 0.6.1-dev (pre-release) or 0.5.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.