The vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted.
Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as viewerid, accesstoken, apiid, and apiresult, potentially allowing authentication as an arbitrary VK user ID.
The issue affects only applications using the vk-app backend.
// patchesThe issue has been fixed by requiring authkey to be present and valid before callback data is trusted.
Users should upgrade to a patched version.
Fix:
// workaroundsApplications that cannot upgrade immediately should disable the vk-app backend by removing socialcore.backends.vk.VKAppOAuth2 from SOCIALAUTHAUTHENTICATIONBACKENDS.
There is no complete workaround while continuing to use the vulnerable backend.
// creditsReported by @lalalala5678 through GitHub private vulnerability reporting.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None