GHSA-826h-28h9-65hg: High severity npm/@backstage/plugin-auth-backend-module-oidc-provider vulnerability
Impact
Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct availability impact is demonstrated.
Patches
Patched in @backstage/plugin-auth-backend-module-oidc-provider version 0.4.20.
Workarounds
- Disable email-based sign-in resolution for the OIDC provider, or require the identity provider to verify email addresses before allowing sign-in.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@backstage/plugin-auth-backend-module-oidc-providerto a version that resolves this vulnerability.Fixed in 0.4.20 - Upgrade
Upgrade
@backstage/plugin-auth-backend-module-oidc-providerto a version that resolves this vulnerability.Fixed in 0.4.20 - Configuration
Disable email-based sign-in resolution, or require the identity provider to verify email addresses before allowing sign-in.
OIDC provider email-based sign-in resolution = disabled
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using OIDC email-based identity resolution are exposed when their identity provider permits users to sign in with unverified email addresses.
What does an attacker need to exploit this issue?
The attacker needs an authenticated account with the OIDC identity provider and must be able to use an unverified email address that matches another catalog identity.
What is the potential impact of successful exploitation?
An attacker may assume another catalog identity and obtain that user's associated access and permissions. No direct availability impact has been demonstrated.
How can the issue be remediated or mitigated?
Upgrade @backstage/plugin-auth-backend-module-oidc-provider to version 0.4.20. If patching is not immediately possible, disable email-based sign-in resolution for the OIDC provider or require the identity provider to verify email addresses before sign-in.