Executive brief
The Microsoft Bot Framework Connector is a library used to build and connect chatbots. A maliciously crafted authentication claim could bypass security checks and allow unauthorized bots to authenticate when the bot is not configured for skill use. An attacker with internal knowledge of the bot's configuration could exploit this to gain unauthorized access or impersonate legitimate skill integrations.
Technical details
This vulnerability is an improper authentication flaw (CWE-287) affecting claims validation in the botframework-connector library. A maliciously crafted claim can be incorrectly authenticated, bypassing the bot's validation logic. The vulnerability requires the attacker to have internal knowledge of the bot's configuration and only impacts bots not configured for skill use. The attack vector is local/internal. The issue has been patched in versions 4.7.3, 4.8.1, 4.9.4, and 4.10.3, with a workaround available through adding a ClaimsValidator authentication configuration.
Affected products
- Microsoft botframework-connector 4.7.0-4.10.1
Timeline
- 2021-02-22: disclosed
- 2021-03-08: patched: Patches released for versions 4.7.3, 4.8.1, 4.9.4, 4.10.3