Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-37260

CVE-2023-37260:
league/oauth2-server key exposed in exception message when passing as a string and providing an invalid pass phrase

8.2

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-37260
GHSA ID
GHSA-wj7q-gjg8-3cpm
EPSS Score
0.78068%
CWE
CWE-200
Published
7/6/2023
Updated
11/5/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
league/oauth2-servercomposer>= 8.3.2, < 8.4.28.4.2
league/oauth2-servercomposer>= 8.5.0, < 8.5.38.5.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from how the CryptKey class handles exception messaging when invalid passphrases are provided with string-based keys. The patches in PR #1353 and PR #1359 specifically modify the exception message in CryptKey's constructor to remove the key value from error output. This indicates the constructor was directly responsible for leaking sensitive key material through exception messages in vulnerable versions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t S*rv*rs t**t p*ss** t**ir k*ys to t** *ryptK*y *onstru*tor *s *s strin* inst*** o* * *il* p*t* will **v* *** t**t k*y in*lu*** in * Lo*i**x**ption m*ss*** i* t**y *i* not provi** * v*li* p*ss p*r*s* *or t** k*y w**r* r*quir**. ### P*t***

Reasoning

T** vuln*r**ility st*ms *rom *ow t** `*ryptK*y` *l*ss **n*l*s *x**ption m*ss**in* w**n inv*li* p*ssp*r*s*s *r* provi*** wit* strin*-**s** k*ys. T** p*t***s in PR #**** *n* PR #**** sp**i*i**lly mo*i*y t** *x**ption m*ss*** in `*ryptK*y`'s *onstru*tor