High-Severity Bug Reported in Google’s OAuth Client Library for Java

Google final thirty day period resolved a superior-severity flaw in its OAuth customer library for Java that could be abused by a destructive actor with a compromised token to deploy arbitrary payloads.

Tracked as CVE-2021-22573, the vulnerability is rated 8.7 out of 10 for severity and relates to an authentication bypass in the library that stems from an incorrect verification of the cryptographic signature.

Credited with exploring and reporting the flaw on March 12 is Tamjid Al Rahat, a fourth-yr Ph.D. student of Personal computer Science at the University of Virginia, who has been awarded $5,000 as part of Google’s bug bounty application.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

“The vulnerability is that the IDToken verifier does not verify if the token is correctly signed,” an advisory for the flaw reads.

“Signature verification helps make positive that the token’s payload will come from a valid provider, not from another person else. An attacker can offer a compromised token with custom made payload. The token will go the validation on the customer facet.”

The open-source Java library, developed on the Google HTTP Client Library for Java, tends to make it feasible to obtain accessibility tokens to any services on the web that supports the OAuth authorization standard.

Google, in its README file for the job on GitHub, notes that the library is supported in routine maintenance method and that it really is only correcting important bugs, indicative of the severity of the vulnerability.

Customers of the google-oauth-java-consumer library are suggested to update to version 1.33.3, introduced on April 13, to mitigate any probable risk.

Identified this posting exciting? Follow THN on Fb, Twitter  and LinkedIn to browse extra exclusive written content we write-up.