CVE-2022-41914: Non-constant-time SCIM token comparison in Zulip Server
Zulip is an open-source team collaboration tool. For organizations with System for Cross-domain Identity Management(SCIM) account management enabled, Zulip Server 5.0 through 5.6 checked the SCIM bearer token using a comparator that did not run in constant time. Therefore, it might theoretically be possible for an attacker to infer the value of the token by performing a sophisticated timing analysis on a large number of failing requests. If successful, this would allow the attacker to impersonate the SCIM client for its abilities to read and update user accounts in the Zulip organization. Organizations where SCIM account management has not been enabled are not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure SCIM account management is not enabled unless required. The issue affects Zulip Server 5.0 through 5.6 only when SCIM account management is enabled.
Zulip Server (SCIM account management) SCIM account management enabled = disable (if not required)
Event History
Frequently Asked Questions
What is CVE-2022-41914?
CVE-2022-41914 is a vulnerability in Zulip Server versions 5.0 through 5.6 that allows an attacker to potentially guess the SCIM bearer token used for SCIM account management.
How does CVE-2022-41914 impact Zulip Server?
CVE-2022-41914 can lead to the compromise of user accounts with SCIM account management enabled in Zulip Server versions 5.0 through 5.6.
What is the severity of CVE-2022-41914?
CVE-2022-41914 has a severity score of 3.7, which is considered low.
How can I fix CVE-2022-41914?
To fix CVE-2022-41914, it is recommended to upgrade to Zulip Server version 5.7 or later, where the vulnerability has been addressed.
Where can I find more information about CVE-2022-41914?
More information about CVE-2022-41914 can be found in the official GitHub commit and security advisory in the references section.