CVE-2021-21411

{"containers": {"cna": {"affected": [{"product": "oauth2-proxy", "vendor": "oauth2-proxy", "versions": [{"status": "affected", "version": ">= 7.0.0, < 7.1.0"}]}], "descriptions": [{"lang": "en", "value": "OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The `--gitlab-group` flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted. Additionally, any authenticated users had whichever groups were set in `--gitlab-group` added to the new `X-Forwarded-Groups` header to the upstream application. While adding GitLab project based authorization support in #630, a bug was introduced where the user session's groups field was populated with the `--gitlab-group` config entries instead of pulling the individual user's group membership from the GitLab Userinfo endpoint. When the session groups where compared against the allowed groups for authorization, they matched improperly (since both lists were populated with the same data) so authorization was allowed. This impacts GitLab Provider users who relies on group membership for authorization restrictions. Any authenticated users in your GitLab environment can access your applications regardless of `--gitlab-group` membership restrictions. This is patched in v7.1.0. There is no workaround for the Group membership bug. But `--gitlab-project` can be set to use Project membership as the authorization checks instead of groups; it is not broken."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-03-26T20:55:14.000Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://pkg.go.dev/github.com/oauth2-proxy/oauth2-proxy/v7"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-652x-m2gr-hppm"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/oauth2-proxy/oauth2-proxy/commit/0279fa7dff1752f1710707dbd1ffac839de8bbfc"}, {"tags": ["x_refsource_MISC"], "url": "https://docs.gitlab.com/ee/user/group/"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.1.0"}], "source": {"advisory": "GHSA-652x-m2gr-hppm", "discovery": "UNKNOWN"}, "title": "Incorrect authorization in OAuth2-Proxy", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-21411", "STATE": "PUBLIC", "TITLE": "Incorrect authorization in OAuth2-Proxy"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "oauth2-proxy", "version": {"version_data": [{"version_value": ">= 7.0.0, < 7.1.0"}]}}]}, "vendor_name": "oauth2-proxy"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The `--gitlab-group` flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted. Additionally, any authenticated users had whichever groups were set in `--gitlab-group` added to the new `X-Forwarded-Groups` header to the upstream application. While adding GitLab project based authorization support in #630, a bug was introduced where the user session's groups field was populated with the `--gitlab-group` config entries instead of pulling the individual user's group membership from the GitLab Userinfo endpoint. When the session groups where compared against the allowed groups for authorization, they matched improperly (since both lists were populated with the same data) so authorization was allowed. This impacts GitLab Provider users who relies on group membership for authorization restrictions. Any authenticated users in your GitLab environment can access your applications regardless of `--gitlab-group` membership restrictions. This is patched in v7.1.0. There is no workaround for the Group membership bug. But `--gitlab-project` can be set to use Project membership as the authorization checks instead of groups; it is not broken."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-863 Incorrect Authorization"}]}]}, "references": {"reference_data": [{"name": "https://pkg.go.dev/github.com/oauth2-proxy/oauth2-proxy/v7", "refsource": "MISC", "url": "https://pkg.go.dev/github.com/oauth2-proxy/oauth2-proxy/v7"}, {"name": "https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-652x-m2gr-hppm", "refsource": "CONFIRM", "url": "https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-652x-m2gr-hppm"}, {"name": "https://github.com/oauth2-proxy/oauth2-proxy/commit/0279fa7dff1752f1710707dbd1ffac839de8bbfc", "refsource": "MISC", "url": "https://github.com/oauth2-proxy/oauth2-proxy/commit/0279fa7dff1752f1710707dbd1ffac839de8bbfc"}, {"name": "https://docs.gitlab.com/ee/user/group/", "refsource": "MISC", "url": "https://docs.gitlab.com/ee/user/group/"}, {"name": "https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.1.0", "refsource": "MISC", "url": "https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.1.0"}]}, "source": {"advisory": "GHSA-652x-m2gr-hppm", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T18:09:16.000Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://pkg.go.dev/github.com/oauth2-proxy/oauth2-proxy/v7"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-652x-m2gr-hppm"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/oauth2-proxy/oauth2-proxy/commit/0279fa7dff1752f1710707dbd1ffac839de8bbfc"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://docs.gitlab.com/ee/user/group/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.1.0"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-21411", "datePublished": "2021-03-26T20:55:14.000Z", "dateReserved": "2020-12-22T00:00:00.000Z", "dateUpdated": "2024-08-03T18:09:16.000Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "oauth2-proxy", "vendor": "oauth2-proxy", "versions": [{"status": "affected", "version": ">= 7.0.0, < 7.1.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oauth2_proxy_project:oauth2_proxy:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5AAF6F8-6CAE-4E37-9DD9-28C967852020", "versionEndExcluding": "7.1.0", "versionStartIncluding": "7.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The `--gitlab-group` flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted. Additionally, any authenticated users had whichever groups were set in `--gitlab-group` added to the new `X-Forwarded-Groups` header to the upstream application. While adding GitLab project based authorization support in #630, a bug was introduced where the user session's groups field was populated with the `--gitlab-group` config entries instead of pulling the individual user's group membership from the GitLab Userinfo endpoint. When the session groups where compared against the allowed groups for authorization, they matched improperly (since both lists were populated with the same data) so authorization was allowed. This impacts GitLab Provider users who relies on group membership for authorization restrictions. Any authenticated users in your GitLab environment can access your applications regardless of `--gitlab-group` membership restrictions. This is patched in v7.1.0. There is no workaround for the Group membership bug. But `--gitlab-project` can be set to use Project membership as the authorization checks instead of groups; it is not broken."}, {"lang": "es", "value": "OAuth2-Proxy es un proxy inverso de c\u00f3digo abierto que proporciona autenticaci\u00f3n con Google, Github u otros proveedores. El flag \"--gitlab-group\" para la autorizaci\u00f3n basada en grupos en el proveedor GitLab dej\u00f3 de funcionar en la versi\u00f3n v7.0.0. Independientemente de la configuraci\u00f3n del flag, la autorizaci\u00f3n no estaba restringida. Adem\u00e1s, cualquier usuario autenticado ten\u00eda los grupos que hab\u00edan sido establecidos en \"--gitlab-group\" a\u00f1adidos al nuevo encabezado \"X-Forwarded-Groups\" para la aplicaci\u00f3n de origen. Al a\u00f1adir la compatibilidad con la autorizaci\u00f3n basada en proyectos de GitLab en el n\u00famero 630, se introdujo un error por el que el campo groups de la sesi\u00f3n del usuario se rellenaba con las entradas de configuraci\u00f3n de \"--gitlab-group\" en lugar de extraer la pertenencia al grupo del usuario individual desde el endpoint de GitLab Userinfo. Cuando los grupos de la sesi\u00f3n se comparaban con los grupos permitidos para la autorizaci\u00f3n, coincid\u00edan incorrectamente (ya que ambas listas se rellenaban con los mismos datos), por lo que se permit\u00eda la autorizaci\u00f3n. Esto afecta a usuarios del proveedor de GitLab que se basan en la pertenencia a grupos para las restricciones de autorizaci\u00f3n. Cualquier usuario autenticado en su entorno de GitLab puede acceder a sus aplicaciones independientemente de las restricciones de pertenencia a grupos de \"--gitlab-group\". Esto ha sido corregido en la versi\u00f3n 7.1.0. No se presenta una soluci\u00f3n para el error de Group membership. Pero \"--gitlab-project\" puede ser configurado para usar Project membership como la comprobaci\u00f3n de la autorizaci\u00f3n en lugar de los grupos; esto no est\u00e1 roto."}], "id": "CVE-2021-21411", "lastModified": "2026-06-17T03:35:31.350", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 5.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-03-26T21:15:13.630", "references": [{"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://docs.gitlab.com/ee/user/group/"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/oauth2-proxy/oauth2-proxy/commit/0279fa7dff1752f1710707dbd1ffac839de8bbfc"}, {"source": "security-advisories@github.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.1.0"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-652x-m2gr-hppm"}, {"source": "security-advisories@github.com", "tags": ["Product", "Third Party Advisory"], "url": "https://pkg.go.dev/github.com/oauth2-proxy/oauth2-proxy/v7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://docs.gitlab.com/ee/user/group/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/oauth2-proxy/oauth2-proxy/commit/0279fa7dff1752f1710707dbd1ffac839de8bbfc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.1.0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-652x-m2gr-hppm"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product", "Third Party Advisory"], "url": "https://pkg.go.dev/github.com/oauth2-proxy/oauth2-proxy/v7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}