CVE-2023-46241: Potential account take over due to unverified emails from Microsoft Identity Platform
First published: Wed Feb 21 2024(Updated: )
`discourse-microsoft-auth` is a plugin that enables authentication via Microsoft. On sites with the `discourse-microsoft-auth` plugin enabled, an attack can potentially take control of a victim's Discourse account. Sites that have configured their application's account type to any options other than `Accounts in this organizational directory only (O365 only - Single tenant)` are vulnerable. This vulnerability has been patched in commit c40665f44509724b64938c85def9fb2e79f62ec8 of `discourse-microsoft-auth`. A `microsoft_auth:revoke` rake task has also been added which will deactivate and log out all users that have connected their accounts to Microsoft. User API keys as well as API keys created by those users will also be revoked. The rake task will also remove the connection records to Microsoft for those users. This will allow affected users to re-verify their account emails as well as reconnect their Discourse account to Microsoft for authentication. As a workaround, disable the `discourse-microsoft-auth` plugin by setting the `microsoft_auth_enabled` site setting to `false`. Run the `microsoft_auth:log_out_users` rake task to log out all users with associated Microsoft accounts.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Discourse Microsoft Authentication | <2024-02-20 | |
| Microsoft Identity Platform | ||
| Discourse Microsoft Authentication |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-46241?
CVE-2023-46241 is considered a high-severity vulnerability that allows potential account takeover.
How do I fix CVE-2023-46241?
To fix CVE-2023-46241, update the `discourse-microsoft-auth` plugin to a version released after February 20, 2024.
What systems are affected by CVE-2023-46241?
CVE-2023-46241 affects installations of Discourse with the `discourse-microsoft-auth` plugin enabled.
What can an attacker do with CVE-2023-46241?
An attacker exploiting CVE-2023-46241 can potentially take control of a victim's Discourse account.
Is there a workaround for CVE-2023-46241?
Temporarily disabling the `discourse-microsoft-auth` plugin can serve as a workaround for CVE-2023-46241.
- agent/weakness
- agent/references
- agent/title
- agent/description
- agent/type
- agent/first-publish-date
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/remedy
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/guess-ai
- agent/tags
- vendor/discourse
- canonical/discourse microsoft authentication
- vendor/microsoft
- canonical/microsoft identity platform