CVE-2023-37260: league/oauth2-server key exposed in exception message when passing as string and providing invalid pass phrase
Impact Servers that passed their keys to the CryptKey constructor as as string instead of a file path will have had that key included in a LogicException message if they did not provide a valid pass phrase for the key where required.
Patches This issue has been patched so that the provided key is no longer exposed in the exception message in the scenario outlined above. Users should upgrade to version 8.5.3 or 8.4.2 to receive the patch.
Workarounds We recommend upgrading the oauth2-server to one of the patched releases (8.5.3 or 8.4.2). If you are unable to upgrade you can avoid this security issue by passing your key as a file instead of a string.
References Fix for 8.4.x Fix for 8.5.x
Other sources
league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Starting in version 8.3.2 and prior to version 8.5.3, servers that passed their keys to the CryptKey constructor as as string instead of a file path will have had that key included in a LogicException message if they did not provide a valid pass phrase for the key where required. This issue has been patched so that the provided key is no longer exposed in the exception message in the scenario outlined above. Users should upgrade to version 8.5.3 to receive the patch. As a workaround, pass the key as a file instead of a string.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/league/oauth2-serverto a version that resolves this vulnerability.Fixed in 8.5.3 - Upgrade
Upgrade
composer/league/oauth2-serverto a version that resolves this vulnerability.Fixed in 8.4.2 - Upgrade
Upgrade
league/oauth2-serverto a version that resolves this vulnerability.Fixed in 8.5.3 - Upgrade
Upgrade
league/oauth2-serverto a version that resolves this vulnerability.Fixed in 8.4.2 - Configuration
As a workaround, pass the key to the CryptKey constructor as a file path instead of a string (to avoid key exposure in a LogicException message when an invalid pass phrase is provided). This applies to versions starting in 8.3.2 and prior to 8.5.3 when the key is passed as a string.
league/oauth2-server (CryptKey constructor usage) key input method (string vs file) = pass key as a file instead of a string
Event History
Frequently Asked Questions
What is the impact of CVE-2023-37260?
Servers that passed their keys to the CryptKey constructor as a string instead of a file path will have had that key included in a LogicException message if they did not provide a valid pass phrase for the key where required.
How can I fix CVE-2023-37260?
Update league/oauth2-server to version 8.5.3 or apply patch 8.4.2 if using versions between 8.3.2 and 8.5.3.
What is the severity of CVE-2023-37260?
The severity of CVE-2023-37260 is high with a score of 8.2.
Where can I find more information about CVE-2023-37260?
You can find more information about CVE-2023-37260 at the following references: [Github Security Advisory](https://github.com/thephpleague/oauth2-server/security/advisories/GHSA-wj7q-gjg8-3cpm), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-37260), [Github Pull Request](https://github.com/thephpleague/oauth2-server/pull/1353).
What CWE categories are associated with CVE-2023-37260?
CVE-2023-37260 is associated with CWE-200 (Information Exposure) and CWE-209 (Information Exposure Through an Error Message).