Junglewise Threat Intelligence

CVE-2016-6582: Doorkeeper gem improper OAuth 2.0 token revocation implementation

CVE-2016-6582 · Severity: critical · CVSS 9.1 · Published 2017-01-23

Vendors: RubyGems.

Executive brief

Doorkeeper, a popular Ruby library used to manage OAuth 2.0 authentication in Rails applications, failed to correctly implement secure token revocation. This flaw means that when a user logs out, their session tokens might not actually be deactivated, allowing an attacker who has previously hijacked a session to continue accessing the account. Additionally, certain configurations could allow unauthorized parties to deactivate tokens belonging to other users, potentially disrupting service.

Technical details

The Doorkeeper gem (versions 1.2.0 to 4.1.0) contains a logic error in its implementation of RFC 7009. Specifically, it failed to revoke tokens for public clients making unauthenticated calls and incorrectly used Bearer token authentication instead of client credential authentication for revocation requests. This root cause prevents proper authorization of confidential clients, meaning they could not securely verify ownership of a token before revoking it. An attacker can exploit this to replay hijacked sessions after a victim attempts to log out, or potentially revoke arbitrary tokens if they have compromised a confidential client. The issue is resolved in version 4.2.0.

Affected products

  • Doorkeeper Project Doorkeeper 1.2.0 through 4.1.0

Timeline

  • 2016-08-03: disclosed: Bug discovered and privately disclosed to maintainer
  • 2016-08-18: patched: Version 4.2.0 released
  • 2017-01-23: advisory: NVD publication date

References

Related threats