CVE-2023-36820 : What You Need to Know

This article provides details about CVE-2023-36820, a vulnerability found in Micronaut Security's IdTokenClaimsValidator logic.

Understanding CVE-2023-36820

CVE-2023-36820 is related to the improper access control vulnerability (CWE-284) in Micronaut Security's IdTokenClaimsValidator logic for the

aud

claim validation.

What is CVE-2023-36820?

Micronaut Security, a security solution for applications, had a flaw in versions prior to 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1. The issue allowed the IdTokenClaimsValidator to skip

aud

claim validation if the token was issued by the same identity issuer/provider, creating a security risk for OIDC setups with multiple applications from the same issuer.

The Impact of CVE-2023-36820

This vulnerability could potentially lead to unauthorized access and security breaches in systems using affected versions of Micronaut Security. Attackers could exploit this flaw to bypass access control measures and gain access to sensitive information.

Technical Details of CVE-2023-36820

The vulnerability is rated with a CVSSv3 base score of 4.8 (Medium severity) with a HIGH attack complexity. The affected versions of Micronaut Security are 3.11.0, 3.10.0, 3.9.0, 3.8.0, 3.7.0, 3.6.0, 3.5.0, 3.4.0, 3.3.0, 3.2.0, and 3.1.0.

Vulnerability Description

The vulnerability arises from the improper access control logic in the IdTokenClaimsValidator, allowing skipped

aud

claim validation, leading to potential unauthorized access.

Affected Systems and Versions

Versions of Micronaut Security prior to 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1 are affected by this vulnerability.

Exploitation Mechanism

Attackers could exploit this issue by utilizing OIDC setups with multiple applications from the same issuer to bypass the

aud

claim validation, gaining unauthorized access.

Mitigation and Prevention

It is essential to take immediate steps to address the CVE-2023-36820 vulnerability and prevent potential security risks in systems using Micronaut Security.

Immediate Steps to Take

Ensure that systems are updated to the patched versions (3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1) to mitigate the vulnerability.

Long-Term Security Practices

Implement secure coding practices, conduct regular security assessments, and stay informed about security updates and patches for all software components.

Patching and Updates

Regularly monitor for security advisories and apply patches promptly to ensure the security of systems using Micronaut Security.