Pierluigi Paganini May 19, 2022

Google addressed a high-severity flaw in its OAuth client library for Java that could allow attackers with a compromised token to deploy malicious payloads.

Google addressed a high-severity authentication bypass flaw in Google OAuth Client Library for Java, tracked as CVE-2021-22573 (CVS Score 8.7), that could be exploited by an attacker with a compromised token to deploy malicious payloads.

The Google OAuth Client Library for Java is designed to work with any OAuth service on the web, not just with Google APIs. The library is built on the Google HTTP Client Library for Java, and it supports Java 7 (or higher) standard (SE) and enterprise (EE), Android 4.0 (or higher), and Google App Engine.

The root cause of the issue is that the IDToken verifier does not verify if the token is properly signed. This means that an attacker can serve a malicious payload that doesn’t come from a trusted provider

“The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token’s payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload.” reads the description published by NIST. “The token will pass the validation on the client side. We recommend upgrading to version 1.33.3 or above”

The vulnerability was reported by the security researcher Tamjid Al Rahat on March 12, the issue was awarded $5,000 as part of the company bug bounty program. Google addressed the issue with the release of the version 1.33.3 in April.

Users of the Google OAuth Client Library for Java are recommended to upgrade to version 1.33.3 or later.

Security Affairs is one of the finalists for the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS. I ask you to vote for me again (even if you have already done it), because this vote is for the final.

Please vote for Security Affairs and Pierluigi Paganini in every category that includes them (e.g. sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog”)

To nominate, please visit: 

https://docs.google.com/forms/d/e/1FAIpQLSdNDzjvToMSq36YkIHQWwhma90SR0E9rLndflZ3Cu_gVI2Axw/viewform

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Google)

[adrotate banner=”5″]

[adrotate banner=”13″]