Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-50708

CVE-2023-50708: yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-50708
GHSA ID
GHSA-w8vh-p74j-x9xp
EPSS Score
0.37915%
CWE
CWE-203
Published
12/18/2023
Updated
12/22/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
yiisoft/yii2-authclientcomposer<= 2.2.142.2.15

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from using strcmp() for security-sensitive comparisons of OAuth1/OAuth2 'state' and OpenID Connect 'nonce' parameters. The commit diff shows replacements of strcmp() with Yii's timing-safe compareString() in these exact locations. The vulnerability report explicitly identifies these three comparison points as vulnerable due to their use of non-constant-time string comparison, which allows potential timing attacks. The high confidence comes from direct code evidence in the patches and explicit advisory references to these specific code locations.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t _W**t kin* o* vuln*r**ility is it? W*o is imp**t**?_ Ori*in*l R*port: > T** O*ut**/* "st*t*" *n* Op*nI* *onn**t "non**" is vuln*r**l* *or * "timin* *tt**k" sin** it's *omp*r** vi* r**ul*r strin* > *omp*rison (inst*** o* `Yii::$*pp->**tS

Reasoning

T** vuln*r**ility st*ms *rom usin* `str*mp()` *or s**urity-s*nsitiv* *omp*risons o* O*ut**/O*ut** 'st*t*' *n* Op*nI* *onn**t 'non**' p*r*m*t*rs. T** *ommit *i** s*ows r*pl***m*nts o* `str*mp()` wit* Yii's `timin*-s*** *omp*r*Strin*()` in t**s* *x**t