CVE-2024-51752

Executive Summary

CVE-2024-51752 is a security vulnerability in the AuthKit library for Next.js, developed by WorkOS. The flaw allows refresh tokens, which are sensitive authentication credentials, to be logged to the console when the debug flag is enabled. While the debug flag is disabled by default, any environment where it is inadvertently or maliciously enabled could expose these tokens. This exposure could lead to session hijacking and unauthorized access to user accounts. The vulnerability has been patched in version 0.13.2, and all users are strongly advised to upgrade immediately. There are no known workarounds.

Supply Chain & Package Security

This vulnerability affects the @workos-inc/authkit-nextjs package, which is distributed via the npm registry. Organizations using this package should verify their dependency tree to ensure they are not using a vulnerable version. The package is a direct dependency for applications integrating WorkOS AuthKit for authentication. The supply chain risk is moderate, as the vulnerability requires the debug flag to be enabled, but the impact is high due to the potential exposure of refresh tokens.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (AV:L) - The attacker needs local access to the logs or console output.
• Attack Complexity (AC): Low (AC:L) - No special conditions are required beyond the debug flag being enabled.
• Privileges Required (PR): Low (PR:L) - The attacker needs to be able to read the logs or console output.
• User Interaction (UI): None (UI:N) - No user interaction is required for exploitation.
• Scope (S): Unchanged (S:U) - The vulnerability does not affect other components.
• Confidentiality (C): High (C:H) - Refresh tokens are sensitive credentials.
• Integrity (I): None (I:N) - The vulnerability does not allow modification of data.
• Availability (A): None (A:N) - The vulnerability does not affect availability.

CVSS Score: 5.5 (Medium)

Threat Level: Medium. The vulnerability requires the debug flag to be enabled, which is not the default configuration. However, if enabled, the impact is significant as it exposes refresh tokens that can be used to impersonate users.

Deep Dive & Mechanics

The AuthKit library for Next.js includes a debug flag intended for development and troubleshooting purposes. When this flag is set to true, the library logs detailed information to the console, including refresh tokens. Refresh tokens are long-lived credentials used to obtain new access tokens without requiring the user to re-authenticate. If an attacker gains access to these logs (e.g., through a compromised server, shared development environment, or CI/CD pipeline), they can use the refresh tokens to generate new access tokens and maintain persistent access to the user's session.

The vulnerability is rooted in the logging mechanism of the library. The code likely uses console.log or a similar logging function to output debug information, and the refresh token is included in the logged data without proper sanitization or redaction.

Vulnerable vs. Patched Code

Vulnerable Code (version < 0.13.2):

// Example of vulnerable code
if (debug) {
  console.log('AuthKit Debug: Refresh Token:', refreshToken);
}

Patched Code (version >= 0.13.2):

// Example of patched code
if (debug) {
  console.log('AuthKit Debug: Refresh Token: [REDACTED]');
}

The patched version redacts the refresh token in the log output, ensuring that even if the debug flag is enabled, the sensitive token is not exposed.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Next.js application using @workos-inc/authkit-nextjs version < 0.13.2.
• The debug flag must be enabled in the AuthKit configuration.

Exploitation Steps:

1. Identify Target: Scan for Next.js applications using WorkOS AuthKit. Look for environment variables or configuration files that might indicate the debug flag is enabled.
2. Gain Access to Logs: Obtain access to the application's console output or log files. This could be through:
   • Compromising a developer's workstation.
   • Accessing a shared development server.
   • Exploiting a separate vulnerability to read log files.
3. Extract Refresh Tokens: Search the logs for lines containing "Refresh Token:" and extract the token value.
4. Use Refresh Token: Use the extracted refresh token to obtain new access tokens and impersonate the user.

Example Command (using curl to simulate token usage):

curl -X POST https://api.workos.com/sessions/token \
  -H "Content-Type: application/json" \
  -d '{"client_id": "your_client_id", "refresh_token": "extracted_refresh_token"}'

Blue Team

Detection:

• Monitor for the debug flag being enabled in AuthKit configuration.
• Alert on any log entries containing "Refresh Token:".
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Immediately upgrade to version 0.13.2 or later.
• If upgrade is not possible, disable the debug flag in production and development environments.
• Rotate all refresh tokens that may have been exposed.
• Review access logs to identify any unauthorized use of refresh tokens.

Indicators of Compromise (IOCs)

• Log Entries: Any log entry containing the string "Refresh Token:" followed by a token value.
• Configuration: The presence of debug: true in the AuthKit configuration.
• Network Traffic: Unusual API calls to WorkOS endpoints using refresh tokens from unexpected IP addresses.

Detection Engineering

YARA Rule

rule Detect_AuthKit_Refresh_Token_Leak {
  meta:
    description = "Detects log entries containing WorkOS AuthKit refresh tokens"
    author = "Valters IT"
    date = "2024-01-01"
    reference = "CVE-2024-51752"
  strings:
    $token_leak = /Refresh Token:\s*[A-Za-z0-9\-._~+/]+={0,2}/
  condition:
    $token_leak
}

Sigma Rule

title: WorkOS AuthKit Refresh Token Leak
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects log entries containing WorkOS AuthKit refresh tokens
author: Valters IT
date: 2024/01/01
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-51752
logsource:
  category: application
  product: nextjs
detection:
  selection:
    EventID: 1
    Message|contains: "Refresh Token:"
  condition: selection
falsepositives:
  - Legitimate debugging sessions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"WorkOS AuthKit Refresh Token Leak"; flow:to_server; content:"Refresh Token:"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update @workos-inc/authkit-nextjs to version 0.13.2 or later.

   npm install @workos-inc/authkit-nextjs@latest
   

2. Disable Debug Flag: Ensure the debug flag is set to false in all environments.
3. Rotate Tokens: Rotate all refresh tokens that may have been exposed.
4. Review Logs: Check existing logs for any leaked refresh tokens and take appropriate action.

Long-Term Measures:

• Implement a policy to never enable debug flags in production.
• Use centralized logging with sensitive data redaction.
• Regularly audit dependencies for known vulnerabilities.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.