-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/smallstep/certificates | go | <= 0.28.4 | 0.29.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is an authorization bypass in Step CA's ACME and SCEP provisioners. The root cause is a flaw in the token authorization logic within the authority.UseToken function. This function was responsible for validating and marking tokens as used but failed to properly handle cases where a provisioner, such as ACME or SCEP, does not support token-based authentication.
The GetTokenID method on these provisioners would return an error, but the calling UseToken function would ignore it, allowing the request to proceed without proper authorization. This could be exploited to bypass authorization checks for operations like certificate renewal and revocation.
The fix addresses this in several ways:
GetTokenID methods for ACME and SCEP provisioners were modified to return a specific error, ErrTokenFlowNotSupported.UseToken function was updated to recognize this specific error and reject any request where the provisioner does not support the token flow.Revoke function to ensure the serial number in the request matches the one in the token, preventing unauthorized revocations.The identified vulnerable functions are those central to the token authorization flow that either contained the flawed logic or called the vulnerable function, as well as the Revoke function which was missing a critical validation check.
authority.UseTokenauthority/authorize.go
authority.authorizeTokenauthority/authorize.go
authority.AuthorizeRenewTokenauthority/authorize.go
authority.Revokeauthority/tls.go
provisioner.ACME.GetTokenIDauthority/provisioner/acme.go
provisioner.SCEP.GetTokenIDauthority/provisioner/scep.go
Ongoing coverage of React2Shell