Security Digest · Critical advisory (no CVE assigned)
GHSA-c8qj-jx8j-fg2w: DotVVM: Missing authorization in AuthorizeActionFilter
Impact All users of the AuthorizeActionFilter class are affected.
CVSS 9.2 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
dotnet list package --vulnerable --include-transitive. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| NuGet | DotVVM | < 4.2.11 | 4.2.11 |
| NuGet | DotVVM | > 4.3.0-preview01-final, < 4.3.15 | 4.3.15 |
| NuGet | DotVVM | >= 5.0.0-preview01-final, < 5.0.0-preview09-final | 5.0.0-preview09-final |
Details
Impact
All users of the AuthorizeActionFilter class are affected. The AuthorizeActionFilter simply does nothing, no “hacking” is needed to bypass the filter.
Patches
DotVVM 4.3.15, 4.2.11 and 5.0.0-preview09 fix this.
Workarounds
As a workaround, you can use the AuthorizeAttribute instead. It implements the same interfaces (correctly). Note that is it deprecated for unrelated reasons, feel free to suppress the warning when using it as action filter.
CVSS: 9.2 (v4.0) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Sources and references
- GitHub Advisory GHSA-c8qj-jx8j-fg2w github.com
- github.com github.com