^{CVE-2021-41580:}Passport-oauth2 package before 1.6.1 for Node.js incorrectly handles authentication failures when OAuth providers return HTTP 200 status codes for errors.

Overview

The vulnerability (CVE-2021-41580) affects the passport-oauth2 Node.js package, which is a widely used OAuth 2.0 authentication strategy for Passport.js. The issue stems from improper error handling when the package attempts to obtain an access token from an OAuth provider. If an OAuth provider returns an HTTP 200 status code while indicating an authentication failure in the response body (rather than using an appropriate error status code), passport-oauth2 may incorrectly process this as a successful authentication.

Applications that implement authorization checks based solely on the presence of an access token, without validating that the token is legitimate or functional, are particularly vulnerable. In these scenarios, an attacker could potentially gain unauthorized access to protected resources despite failing the actual authentication process.

Remediation

To address this vulnerability, take the following actions:

1. Update the passport-oauth2 package to version 1.6.1 or later, which properly handles this error condition.

2. Implement proper token validation in your application:

   • Always verify the validity of received OAuth tokens
   • Don't rely solely on the presence of a token to grant authorization
   • Implement additional checks to validate user authentication status

3. Review your OAuth provider configuration to ensure it follows proper error reporting standards, using appropriate HTTP status codes for authentication failures.

4. If you cannot update immediately, implement additional middleware or logic to verify authentication success beyond just checking for the presence of a token.

References

1. Fix commit: https://github.com/jaredhanson/passport-oauth2/commit/8e3bcdff145a2219033bd782fc517229fe3e05ea
2. Version comparison showing changes: https://github.com/jaredhanson/passport-oauth2/compare/v1.6.0...v1.6.1
3. Pull request with fix details: https://github.com/jaredhanson/passport-oauth2/pull/144
4. MITRE CVE Entry: CVE-2021-41580