National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

CVE-2020-5300 Detail

Current Description

In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method 'private_key_jwt' [1], OpenId specification says the following about assertion `jti`: "A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties". Hydra does not check the uniqueness of this `jti` value. Exploiting this vulnerability is somewhat difficult because: - TLS protects against MITM which makes it difficult to intercept valid tokens for replay attacks - The expiry time of the JWT gives only a short window of opportunity where it could be replayed This has been patched in version v1.4.0+oryOS.17

Source:  MITRE
View Analysis Description

Severity



CVSS 3.x Severity and Metrics:

NIST CVSS score
NIST: NVD
Base Score: 5.3 MEDIUM
Vector:  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Nist CVSS score does not match with CNA score
CNA:  GitHub, Inc.
Base Score: 5.8 MEDIUM
Vector:  CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink Resource
https://github.com/ory/hydra/commit/700d17d3b7d507de1b1d459a7261d6fb2571ebe3 Patch Third Party Advisory
https://github.com/ory/hydra/releases/tag/v1.4.0 Third Party Advisory
https://github.com/ory/hydra/security/advisories/GHSA-3p3g-vpw6-4w66 Third Party Advisory

Weakness Enumeration

CWE-ID CWE Name Source
CWE-294 Authentication Bypass by Capture-replay NIST   GitHub, Inc.  

Known Affected Software Configurations Switch to CPE 2.2

Configuration 1 ( hide )
 cpe:2.3:a:ory:hydra:*:*:*:*:*:*:*:*
     Show Matching CPE(s)
Up to (excluding)
1.4.0


Change History

1 change record found - show changes

Quick Info

CVE Dictionary Entry:
CVE-2020-5300
NVD Published Date:
04/06/2020
NVD Last Modified:
04/07/2020