by Kastro
Paper/Archive/CVE-2022-31053

CVE-2022-31053

biscuit-auth biscuit — Signature forgery in Biscuit

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 63.2.632 × 2012.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. There are no known workarounds for this issue.

Affected

ProductAffectedFixed inSource
biscuitbiscuit-auth >= 1.0.0, < 2.0.0–CNA
biscuitbiscuit-haskell = 0.1.1.0–CNA
biscuitcom.clever-cloud.biscuit-java < 2.0.0–CNA
biscuitgithub.com/biscuit-auth/biscuit-go < 2.0–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/biscuit-auth/biscuit/security/advisories/GHSA-75rw-34q6-72crrefeprint.iacr.org/2020/1484