Archived

This repository has been archived on 2024-05-31. You can view files and clone it, but cannot push or open issues or pull requests.

Jens L db95dfe38d

security: fix CVE 2022 46145 (#4140 )

* add flow authentication requirement

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* add website for cve

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* add tests

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* flows: handle FlowNonApplicableException without policy result

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* add release notes

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

2022-12-02 16:14:25 +01:00

622 B

Raw Blame History

CVE-2022-46145

Unauthorized user creation and potential account takeover

Impact

With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified password recovery, this can be used to overwrite the email address of admin accounts and take over their accounts

Patches

authentik 2022.11.2 and 2022.10.2 fix this issue, for other versions the workaround can be used.

Workarounds

A policy can be created and bound to the default-user-settings-flow flow with the following contents

return request.user.is_authenticated

622 B Raw Blame History