From 38e04ae12720e5d81b4f7ac77997eb8d1275d31a Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Mon, 29 Jan 2024 17:00:57 +0100 Subject: [PATCH] security: fix CVE-2024-23647 Signed-off-by: Jens Langhammer --- authentik/providers/oauth2/views/token.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/authentik/providers/oauth2/views/token.py b/authentik/providers/oauth2/views/token.py index 4168edb1eb4b..4467579c3f7c 100644 --- a/authentik/providers/oauth2/views/token.py +++ b/authentik/providers/oauth2/views/token.py @@ -232,7 +232,7 @@ def __post_init_code(self, raw_code: str, request: HttpRequest): if self.authorization_code.code_challenge: # Authorization code had PKCE but we didn't get one if not self.code_verifier: - raise TokenError("invalid_request") + raise TokenError("invalid_grant") if self.authorization_code.code_challenge_method == PKCE_METHOD_S256: new_code_challenge = ( urlsafe_b64encode(sha256(self.code_verifier.encode("ascii")).digest()) @@ -245,6 +245,10 @@ def __post_init_code(self, raw_code: str, request: HttpRequest): if new_code_challenge != self.authorization_code.code_challenge: LOGGER.warning("Code challenge not matching") raise TokenError("invalid_grant") + # Token request had a code_verifier but code did not have a code challenge + # Prevent downgrade + if not self.authorization_code.code_challenge and self.code_verifier: + raise TokenError("invalid_grant") def __post_init_refresh(self, raw_token: str, request: HttpRequest): if not raw_token: