Medium, CVSS 5.3NuGetPublished
Bunkum tokens cached in the AuthenticationService are susceptible to a use-after-free
CVE-2023-45814 · GHSA-jrf2-h5j6-3rrq
- Affected
- NuGet bunkum >= 4.0.0, < 4.2.1
- Fixed in
- 4.2.1· Vendor fix available
- Issue
- Impact First, a little bit of background. So, in the beginning, Bunkum's AuthenticationService only supported injecting IUsers. However, as Refresh and SoundShapesServer implemented permissions systems support for injecting ITokens into endpoints was added. All was well until 4.0. Bunkum 4.0 then changed to enforce relations between ITokens and IUsers. This wasn't implemented in a very good way in the AuthenticationService, and ended up breaking caching in such a way that cached tokens would persist after the lifetime of the request - since we tried to cache both tokens and users. From that point until now, from what I understand, Bunkum was attempting to use that cached token at the start of the next request once cached. Naturally, when that token expired, downstream projects like Refresh would remove the object from Realm - and cause the object in the cache to be in a detached state, causing an exception from invalid use of IToken.User. So in other words, a use-after-free since…
Recommended action: Upgrade to 4.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.