Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper
    automatically processes authorization requests without user consent for public clients that have been
    previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be
    assured. This issue is fixed in version 5.6.6. (CVE-2023-34246)

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-3989 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3989-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     December 09, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : ruby-doorkeeper     Version        : 5.3.0-2+deb11u1     CVE ID         : CVE-2023-34246     Debian Bug     : 1038950

    Improper Authentication has been fixed in ruby-doorkeeper,     an OAuth 2 provider for Rails and Grape.

    For Debian 11 bullseye, this problem has been fixed in version     5.3.0-2+deb11u1.

    We recommend that you upgrade your ruby-doorkeeper packages.

    For the detailed security status of ruby-doorkeeper please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ruby-doorkeeper

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3494 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3494-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     July 12, 2023                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : ruby-doorkeeper     Version        : 4.4.2-1+deb10u1     CVE ID         : CVE-2023-34246     Debian Bug     : 1038950

    It was discovered that there was an issue in ruby-doorkeeper, a     OAuth2 provider for Ruby on Rails applications. Doorkeeper     automatically processed authorization requests without user consent     for public clients that have been previously approved, but public     clients are inherently vulnerable to impersonation as their identity     cannot be assured.

    For Debian 10 buster, this problem has been fixed in version     4.4.2-1+deb10u1.

    We recommend that you upgrade your ruby-doorkeeper packages.

    For the detailed security status of ruby-doorkeeper please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ruby-doorkeeper

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 host has a package installed that is affected by a vulnerability as referenced in the USN-6210-1 advisory.

    It was discovered that Doorkeeper incorrectly performed authorization checks for public clients that have     been previous approved. An attacker could potentially exploit these in order to impersonate another user     and obtain sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
412295	SCA: security update for doorkeeper (GHSA-7w2c-w47h-789w)	Tenable Cloud Security	SCA Checks	medium
412295	SCA: security update for doorkeeper (GHSA-7w2c-w47h-789w)	Tenable Self-Hosted Container Security	SCA Checks	medium
212168	Debian dla-3989 : ruby-doorkeeper - security update	Nessus	Debian Local Security Checks	medium
178218	Debian dla-3494 : ruby-doorkeeper - security update	Nessus	Debian Local Security Checks	medium
178106	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 : Doorkeeper vulnerability (USN-6210-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2023-34246

medium

Tenable Plugins

medium

medium

medium

medium

medium