GHSA-8cfq-jgf7-8m27: traQ: Privilege escalation by OAuth prompt=none request
traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all scopes registered for the client become eligible for issuance. An attacker who controls an OAuth client capable of receiving authorization codes can target a user who previously consented to only some client scopes and obtain an access token containing broader registered scopes without additional consent. A user who has never consented to the client still receives consentrequired. This issue is fixed in version 3.28.3.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
traQto a version that resolves this vulnerability.Fixed in 3.28.3
Event History
Frequently Asked Questions
Which users are exposed to unauthorized scope expansion?
Users who have previously granted the affected OAuth client consent for at least some scopes are exposed. Users who have never consented to that client receive a consent_required response instead.
What does an attacker need to exploit this issue?
The attacker must control an OAuth client that can receive authorization codes and cause a previously consenting user to make a silent authorization request with prompt=none and an empty or omitted scope parameter. The client must have broader scopes registered than those the user previously approved.
Are default OAuth requests affected?
The issue specifically affects silent authorization requests using prompt=none when scope is empty or omitted. The vulnerable consent check compares against an empty requested scope set while allowing all scopes registered for the client to be issued.
What version fixes the issue?
Upgrade traQ to version 3.28.3. The issue affects versions prior to 3.28.3.