CVE-2024-42476

Summary

In the OAuth library for nim prior to version 0.11, the Authorization Code grant and Implicit grant both rely on the state parameter to prevent cross-site request forgery (CSRF) attacks where a resource owner might have their session associated with protected resources belonging to an attacker. When this project is compiled with certain compiler flags set, it is possible that the state parameter will not be checked at all, creating a CSRF vulnerability. Version 0.11 checks the state parameter using a regular if statement or doAssert instead of relying on a plain assert. doAssert will achieve the desired behavior even if -d:danger or --assertions:off is set.

Affected Software

VendorProductVersion RangeStatus
CORDEAoauth< 0.11affected

Weaknesses

  • CWE-352: CWE-352: Cross-Site Request Forgery (CSRF)

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References