CVE-2024-6832: Ash Auth one-time login token leaked via URL query string (CWE-532/598)

Vulnerability Summary: One-Time Login Token in URL Query String Vulnerability Overview Vulnerability Title: The one-time login token is placed in the URL query string, where it is logged by proxy logs and browser history, leading to credential exposure. CVE ID: CVE-2024-6832 Severity: Low Weakness: CWE-532, CWE-598 Core Issue: The authentication component places a one-time login token in the URL query string ( ) and redirects the browser after a successful login. This token is a credential, meaning any middleware that logs the full URL (reverse proxies, CDNs, load balancers, telemetry pipelines, browser history) will record this credential. Affected Versions Affected Versions: - (introduced by 989f3a3, "feat: support new sign in tokens feature on password strategy") - (the 3.0 line refactored surrounding code but did not change the mechanism) Fixed Versions: , Impact: Any entity capable of reading the logged URLs (carriers/proxies, CDN/load balancer logs, telemetry capturing full URLs) can obtain the credential, thereby gaining a full authenticated session. Mitigating Factors: The token lifetime is only 60 seconds, and the token is invalidated after each redirect (via and query revocation store), resulting in a very short actual exposure window; therefore, the severity is rated as Low. Remediation Core Fix: Change the token transmission from the URL query string to the POST request body. This fix spans two packages: - : Route changed from GET to POST - : (Disclosed in GHSA-J7Z8-59W4-r46f) Upgrade Recommendations: 1. Upgrade to or , and to or 2. Set to (within the password strategy) Note: Upgrading alone does not close this issue because the query string redirect remains the default behavior; must also be set to simultaneously. Other Mitigations: - Ensure middleware does not log the query string of authentication URLs - Set to to exclude the token redirect path - Shorten to less than 60 seconds to further reduce the replay window Related Code/Configuration Request Executed by Browser: Key Configuration Items: - (default ) - (default 60 seconds) - (must be set to after the fix) References — "feat: support new sign in tokens feature on password strategy"

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-6832: Ash Auth one-time login token leaked via URL query string (CWE-532/598)

More from this source