SecBoard
Zurück zur CVE-Übersicht

CVE-2026-72887

CRITICAL(9.8)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score25/100 — MITTEL
  • CVSS 9.8 — Kritisch

EPSS-Score

0.5%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.8

Technische Schwere

Beschreibung

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token. Passing a callback to the constructor selects OAuth 1.0a. get_request_token then revokes that choice when the request token response omits oauth_callback_confirmed, with no exception, no warning and no option to require 1.0a. The access token request is built from the OAuth 1.0 message class, which has no verifier parameter, so oauth_verifier is dropped from the request even when get_access_token was passed one. oauth_verifier is the binding that OAuth 1.0a added between the authorization step and the token exchange. An application that asked for 1.0a and gets 1.0 is open to OAuth 1.0 session fixation, where an attacker obtains a request token, has the victim authorize it, and then completes the exchange themselves, linking the victim's provider account to a session the attacker controls. No attacker action sets up the downgrade: a provider that does not confirm the callback is enough.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 0.32

Threat-Hunting-Queries

Die Schwachstelle betrifft die Perl-Bibliothek Net::OAuth::Client, die eine stille Herabstufung von OAuth 1.0a auf 1.0 ermöglicht, wenn der Service Provider 'oauth_callback_confirmed' weglässt. Dies führt zum Verlust des 'oauth_verifier'-Parameters und ermöglicht Session Fixation. Die Erkennung erfordert die Überwachung von OAuth-Authentifizierungsflüssen, insbesondere auf das Fehlen von 'oauth_ca

Sentinel/Defender KQL

AuditLogs
| where OperationName == "OAuthRequestToken" // Beispiel: Anwendungs- oder Proxy-Logs für OAuth-Anfragen
| extend RequestTokenResponse = parse_json(RawResponse) // Annahme: JSON-Antwort
| where RequestTokenResponse.oauth_callback_confirmed !has "true" // Prüfen, ob oauth_callback_confirmed fehlt oder nicht bestätigt ist
| where ClientApplication == "YourPerlApplication" // Anpassen an die betroffene Anwendung
| project TimeGenerated, ClientApplication, RequestUri, RequestTokenResponse

Splunk SPL

sourcetype=your_application_logs "OAuthRequestToken" NOT "oauth_callback_confirmed" | rex field=_raw "(?<RequestTokenResponse>\{.*\})" | spath input=RequestTokenResponse | search NOT oauth_callback_confirmed=* | table _time, host, source, RequestUri, RequestTokenResponse

Sigma

title: Net::OAuth::Client Downgrade Detection
author: SecBoard
date: 2026/08/16
logsource:
  product: application
  service: oauth_client
detection:
  selection:
    event_type: 'oauth_request_token_response'
    # Annahme: Log-Feld, das die Bestätigung des Callbacks anzeigt
    oauth_callback_confirmed: 'false' # Oder Feld fehlt
  condition: selection
fields:
  - 'source_ip'
  - 'destination_ip'
  - 'user'
  - 'application_name'
tags:
  - 'attack.initial_access'
  - 'cve.2026.72887'
level: high

Elastic ES|QL

FROM your_application_logs
| WHERE event.category == "authentication" AND event.action == "oauth_request_token_response"
| WHERE NOT has_field(oauth.callback_confirmed) OR oauth.callback_confirmed == false
| WHERE application.name == "YourPerlApplication" // Anpassen an die betroffene Anwendung
| SELECT @timestamp, host.name, application.name, url.full, oauth.callback_confirmed

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen