Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the OAuth2 consent flow to proceed without restricting approve to POST, without a csrf_token in frappe/templates/includes/oauth_confirmation.html, and without scoping an active OAuth token check to the requesting client. An attacker can cause an authenticated user to approve an OAuth grant or reuse authorization state for the wrong client, exposing data and permitting actions within the granted scopes.
This issue is fixed in versions 15.114.0 and 16.26.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Active
User action required
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 9
https://github.com/frappe/frappe/commit/336c7d335db762b494acdfe43aea69d459fd51d7
security-advisories@github.com
https://github.com/frappe/frappe/commit/d7460769f999c68d3121b680119f8724ddd3eb9d
security-advisories@github.com
https://github.com/frappe/frappe/commit/eb9c1446cac13236c6d573b136786db2e46254fa
security-advisories@github.com
https://github.com/frappe/frappe/pull/40073
security-advisories@github.com
https://github.com/frappe/frappe/pull/40700
security-advisories@github.com
https://github.com/frappe/frappe/pull/40701
security-advisories@github.com
https://github.com/frappe/frappe/releases/tag/v15.114.0
security-advisories@github.com
https://github.com/frappe/frappe/releases/tag/v16.26.0
security-advisories@github.com
https://github.com/frappe/frappe/security/advisories/GHSA-2ph8-x773-8p2x
security-advisories@github.com