CVE-2023-41900: Jetty's OpenId Revoked authentication allows one request
If a Jetty OpenIdAuthenticator uses the optional nested LoginService, and that LoginService decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated.
So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the LoginService.
Impact This impacts usages of the jetty-openid which have configured a nested LoginService and where that LoginService will is capable of rejecting previously authenticated users.
Original Report > working on a custom OpenIdAuthenticator, I discovered the following: > > https://github.com/eclipse/jetty.project/blob/jetty-10.0.14/jetty-openid/src/main/java/org/eclipse/jetty/security/openid/OpenIdAuthenticator.java#L505 > > In the case where the LoginService does return that the authentication has been revoked (from the validate() call on line 463), the OpenIdAuthenticator removes the authentication from the session; however the current request still proceeds as if authenticated, since it falls through to "return authentication" on line 505. > > This is fixed by moving the line 505 (and associated debug log) inside the else block that ends on line 502, instead of outside it. Then the revocation case will run through to line 517 and will trigger a new OpenId authentication which I think is correct. > > I think this revocation can only occur if you do attach a separate LoginService to the OpenIdLoginService, but in that case the revoked authentication will still let the next request through (and possibly more than one if they are very close to simultaneous). > > Technically I think this is a security vulnerability, if a very minor one, so I'm sending this off-list.
Patched Versions
Fixed in Jetty Versions: 9.4.52 - fixed in PR https://github.com/eclipse/jetty.project/pull/9660 10.0.16 - fixed in PR https://github.com/eclipse/jetty.project/pull/9528 11.0.16 - fixed in PR https://github.com/eclipse/jetty.project/pull/9528 12.0.0 - not impacted (already has fix)
Workaround Upgrade your version of Jetty.
References https://github.com/eclipse/jetty.project/pull/9528 https://github.com/eclipse/jetty.project/pull/9660
Other sources
Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty OpenIdAuthenticator uses the optional nested LoginService, and that LoginService decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the LoginService. This impacts usages of the jetty-openid which have configured a nested LoginService and where that LoginService will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/jetty9to a version that resolves this vulnerability.Fixed in 9.4.16-0+deb10u1Fixed in 9.4.50-4+deb10u1Fixed in 9.4.39-3+deb11u2Fixed in 9.4.50-4+deb11u1Fixed in 9.4.50-4+deb12u2Fixed in 9.4.53-1 - Upgrade
Upgrade
maven/org.eclipse.jetty:jetty-openidto a version that resolves this vulnerability.Fixed in 9.4.52.v20230823 - Upgrade
Upgrade
maven/org.eclipse.jetty:jetty-openidto a version that resolves this vulnerability.Fixed in 11.0.16 - Upgrade
Upgrade
maven/org.eclipse.jetty:jetty-openidto a version that resolves this vulnerability.Fixed in 10.0.16 - Upgrade
Upgrade
redhat/jettyto a version that resolves this vulnerability.Fixed in 9.4.52 - Upgrade
Upgrade
redhat/jettyto a version that resolves this vulnerability.Fixed in 10.0.16 - Upgrade
Upgrade
redhat/jettyto a version that resolves this vulnerability.Fixed in 11.0.16 - Upgrade
Upgrade
eclipse/jetty (jetty-openid/OpenIdAuthenticator)to a version that resolves this vulnerability.Fixed in 10.0.16Patch PR https://github.com/eclipse/jetty.project/pull/9528 - Upgrade
Upgrade
eclipse/jetty (jetty-openid/OpenIdAuthenticator)to a version that resolves this vulnerability.Fixed in 11.0.16Patch PR https://github.com/eclipse/jetty.project/pull/9528 - Upgrade
Upgrade
eclipse/jetty (jetty-openid/OpenIdAuthenticator)to a version that resolves this vulnerability.Fixed in 9.4.52Patch PR https://github.com/eclipse/jetty.project/pull/9660 - Configuration
If you maintain a custom Jetty OpenIdAuthenticator, modify OpenIdAuthenticator.java so the logic that returns the existing authentication occurs inside the else block (ending on line 502), ensuring that when validate() indicates revoked authentication it does not fall through and treat the current request as authenticated (per the fix described for Jetty-10.0.14 line references).
Jetty OpenIdAuthenticator (jetty-openid) Placement of return(authentication) logic in validate() flow = Move the line 505 (and associated debug log) inside the else block that ends on line 502 instead of outside it
Event History
Frequently Asked Questions
What is CVE-2023-41900?
CVE-2023-41900 is a vulnerability in Jetty, a Java-based web server and servlet engine, which allows an authenticated user to have their authentication cleared from the session.
How severe is CVE-2023-41900?
CVE-2023-41900 has a severity rating of 4.3, which is considered medium.
Which versions of Jetty are affected by CVE-2023-41900?
Jetty versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.0 through 11.0.15 are affected by CVE-2023-41900.
How can I fix CVE-2023-41900?
To fix CVE-2023-41900, you should update Jetty to version 9.4.52, 10.0.16, or 11.0.16, depending on your current version.
Are there any references for CVE-2023-41900?
Yes, you can find references for CVE-2023-41900 at the following links: [URL1], [URL2], [URL3].