1813629 - (CVE-2023-4657) Full Account Takeover on Bugzilla instances using Github authentication

Status: RESOLVED FIXED

(Bugzilla :: User Accounts, defect)

Description

[Dave Miller [:justdave]]

+++ This bug was initially created as a clone of Bug #1811297 +++

Hi There.
In email Address, regular and illegal characters are different.
This defies different account. Like [e-mail] and maä[e-mail] are different email accounts.
This idna confusion occurs on BMO.

Steps To Reproduce.

1. Create your interactsh instance. copy the domain and construct 2 separate email address, i.e. maal@vaal.<interactsh> as regular one and <maä[e-mail]> as illegal one.
2. Create account on BMO using regular email address and verify it.
3. Now after you finish verification process, Create account on github using illegal email address.
4. Verify it. And now use login with github to takeover account on BMO.

#Notice
The email from bugzilla and github verification goes to separate users , i.e. maal and maäl are different from each other..
Here is the link to create interactsh instance.
https://app.interactsh.com

I do have submitted a POC video. Do watch to reproduce the steps.
Thanks
Best Regards
Aaryan9898

Comment 1

[Dave Miller [:justdave]]

Note that the primary exploit only affects the harmony branch which has not yet been included in any published Bugzilla release.

The theoretical impact is still possible in the 3 production branches, but no way to exploit it is currently known (should be fixed for future-proofing, but not currently exploitable because no auth plugins currently make use of this user matching mechanism).

Comment 2

[Dave Miller [:justdave]]

The patch from BMO applies cleanly on the harmony branch. The first chunk of it will apply cleanly on the other three branches (with fuzz) as long as it's separate from the second chunk.

Comment 3

[Dave Miller [:justdave]]

Attachment: patch for Harmony

This is the patch that was used on BMO, which applies cleanly on Harmony.

Comment 4

[Dave Miller [:justdave]]

Attachment: patch for 4.4 and 5.0.4 branches

Comment 5

[Dave Miller [:justdave]]

Attachment: patch for 5.2 branch and master (5.1)

Comment 6

[Dave Miller [:justdave]]

Vulnerability description:

When using external authentication against a third party service (such as GitHub) which allows non-ASCII Unicode characters to be used in email addresses, Bugzilla's email address match would normalize the email into ASCII before comparing when using MySQL as a back end, enabling someone to take over a Bugzilla account if they created a user with an email address which would match that way on such a third party service.

We are not aware of any known exploits for versions prior to the "harmony" developer branch which has not yet been released, as prior to that there were no authentication plugins for third party auth in Bugzilla. However, we are patching the earlier supported versions to prevent it anyway just in case someone had written their own plugin that might be affected.

Affected versions:

known exploitable -> checkouts from the "harmony" git repository prior to August 29, 2024.
not known to be exploitable, but fixed as a caution:
4.4.x versions prior to 4.4.14 -> upgrade to 4.4.14
5.0.x versions prior to 5.0.4.1 -> upgrade to 5.0.4.1
5.0.5 and 5.0.6 -> upgrade to 5.2
Developer snapshots in 5.1.x/5.3.x prior to 5.3.3 -> upgrade to 5.3.3

dveditz: can we get a CVE for this?

Comment 7

[r3dpars3c]

Hi There !
I don't wish to Disclose this .
I want to keep it confidential till my research periods.

Thanks
Best Regards
Aaryan9898

Comment 8

[Daniel Veditz [:dveditz]]

dveditz: can we get a CVE for this?

Our current pool is empty to I'm tossing this to Tom who knows how to get more in the new process

Comment 9

[Daniel Veditz [:dveditz]]

I don't wish to Disclose this . I want to keep it confidential till my research periods.

When is that? You first reported this in January so we're well past the typical 90-day embargo period or even the 120-day one that some companies use. It's not responsible to leave the users of these systems vulnerable if we have patches ready for them.

Comment 10

[r3dpars3c]

Its alright to assign CVE.
But Don’t disclose the exploit method.
Thanks for your understanding.

Comment 11

[Dave Miller [:justdave]]

The exploit method will effectively be disclosed when we release the version of Bugzilla that contains the fix for it, which is currently scheduled for Aug 30, unless we completely withhold the fix as well, which would be kind of irresponsible at this point. The nature of the issue is evident from the patch.

Comment 12

[r3dpars3c]

Thanks
Best Regards
Aaryan9898

Comment 13

[Dave Miller [:justdave]]

(In reply to Dave Miller [:justdave] from comment #11)

currently scheduled for Aug 30

Just FYI, this release has been delayed (probably a day or two) due to outside factors influencing the availability of people involved in the release process.

Comment 14

[Dave Miller [:justdave]]

The delay ended up going much longer because of the state of the release process and lack of developer time. This will be landing and getting released in the next few hours.

Comment 15

[Dave Miller [:justdave]]

The code which allowed third party authentication plugins to be created was added in version 3.3.1, so that's technically the theoretical oldest version that could be affected by this.

Comment 16

[Dave Miller [:justdave]]

The final patches can be found in the commits as follows:

4.4: https://github.com/bugzilla/bugzilla/commit/167867ff35c01b67f134ba7845834c8641525c83
5.0.4: https://github.com/bugzilla/bugzilla/commit/004ee037b0f49a549648a84b568188ec49bccac7
5.2: https://github.com/bugzilla/bugzilla/commit/718c0e1c6d965ffe3c7e2586b22b0e205697392f
5.3: https://github.com/bugzilla/bugzilla/commit/3467392498aa0f8ff9e60e6424d1b2b904d8c898
harmony: https://github.com/bugzilla/harmony/commit/07475c66f6bdc8f7b19d23c5f0c57b0bbd5bd055