CVE-2024-51753

Executive Summary

CVE-2024-51753 is a security vulnerability in the AuthKit library for Remix, developed by WorkOS. The flaw involves the inadvertent logging of refresh tokens to the console when the debug flag is enabled. While the debug flag is disabled by default, any user or administrator who enables it for troubleshooting purposes will expose sensitive authentication tokens in plaintext logs. This can lead to unauthorized account access and session hijacking. The vulnerability has been patched in version 0.4.1, and all users are strongly advised to upgrade immediately. There are no known workarounds.

Supply Chain & Package Security

This vulnerability affects the @workos-inc/authkit-remix npm package. As an npm package, it is part of the JavaScript/TypeScript supply chain. Users of this package should verify their dependency tree and ensure they are not inadvertently using a vulnerable version. The package is used for authentication and session management in Remix applications, making it a critical component for security.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Adjusted Score: 5.5 (Medium)
• Attack Vector (AV): Local (AV:L) - The attacker must have local access to the logs.
• Attack Complexity (AC): Low (AC:L) - No special conditions required.
• Privileges Required (PR): Low (PR:L) - The attacker needs some privileges to access logs.
• User Interaction (UI): None (UI:N) - No user action required.
• Scope (S): Unchanged (S:U) - The vulnerability does not affect other components.
• Confidentiality (C): High (C:H) - Refresh tokens are exposed.
• Integrity (I): None (I:N) - No data modification.
• Availability (A): None (A:N) - No impact on availability.
• Threat Level: Medium. The vulnerability requires the debug flag to be enabled, which is not default, but the impact of token exposure is severe.

Deep Dive & Mechanics

The AuthKit library for Remix includes a debug flag intended for development and troubleshooting. When enabled, the library logs detailed information about authentication flows, including refresh tokens. Refresh tokens are long-lived credentials used to obtain new access tokens without requiring the user to re-authenticate. If an attacker gains access to these logs, they can use the refresh tokens to impersonate users and maintain persistent access.

The vulnerability exists in the logging mechanism of the library. The code that handles the debug flag does not sanitize or redact sensitive data before outputting it to the console. This is a classic case of CWE-532: Insertion of Sensitive Information into Log File.

Vulnerable vs. Patched Code

Vulnerable Code (version < 0.4.1):

if (debug) {
  console.log('AuthKit Debug:', {
    accessToken,
    refreshToken, // Sensitive data logged
    user,
  });
}

Patched Code (version >= 0.4.1):

if (debug) {
  console.log('AuthKit Debug:', {
    accessToken: accessToken ? '***REDACTED***' : undefined,
    refreshToken: refreshToken ? '***REDACTED***' : undefined, // Redacted
    user,
  });
}

The patch replaces the actual token values with a redacted string, preventing exposure in logs.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Remix application using AuthKit with the debug flag enabled.
• Ability to read application logs (e.g., via console, log files, or monitoring tools).

Exploitation Steps:

1. Identify a target application using AuthKit with debug enabled (e.g., via error messages or log analysis).
2. Gain access to the application logs (e.g., through a compromised server, log aggregation service, or insider access).
3. Search logs for AuthKit Debug entries.
4. Extract the refreshToken value from the log entry.
5. Use the refresh token to obtain new access tokens and impersonate the user.

Example Log Extraction:

grep 'AuthKit Debug' /var/log/app.log | grep 'refreshToken'

Token Usage:

curl -X POST https://api.workos.com/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=refresh_token&refresh_token=EXTRACTED_TOKEN&client_id=YOUR_CLIENT_ID"

Blue Team

Detection:

• Monitor for the presence of AuthKit Debug in logs.
• Alert on any log entries containing refreshToken in plaintext.
• Use the provided Sigma rule to detect debug flag usage.

Prevention:

• Ensure the debug flag is never enabled in production environments.
• Implement log redaction for sensitive fields.
• Use centralized logging with access controls.

Response:

• If tokens are exposed, immediately rotate all affected refresh tokens.
• Revoke sessions and force re-authentication for affected users.
• Investigate how the logs were accessed and remediate the access vector.

Indicators of Compromise (IOCs)

• Log Entries: AuthKit Debug followed by JSON containing refreshToken.
• Network Traffic: Unusual token refresh requests to WorkOS API from unexpected IPs.
• File Hashes: N/A (No specific malware).
• Processes: N/A (No specific processes).

Detection Engineering

YARA Rule

rule Detect_AuthKit_Debug_Logging {
  meta:
    description = "Detects AuthKit debug log entries containing refresh tokens"
    author = "Valters IT"
    date = "2024-01-01"
    reference = "CVE-2024-51753"
  strings:
    $debug = "AuthKit Debug"
    $token = "refreshToken"
  condition:
    all of them
}

Sigma Rule

title: AuthKit Debug Logging with Refresh Token
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects when AuthKit debug logging is enabled and refresh tokens are logged
author: Valters IT
date: 2024/01/01
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-51753
logsource:
  product: application
  service: generic
detection:
  selection:
    - EventID: 1
      Message: "*AuthKit Debug*refreshToken*"
  condition: selection
falsepositives:
  - Legitimate debugging sessions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-51753 AuthKit Debug Logging"; flow:to_server; content:"AuthKit Debug"; http_client_body; content:"refreshToken"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to @workos-inc/authkit-remix version 0.4.1 or later.
2. If upgrade is not possible, disable the debug flag in all environments.
3. Rotate any refresh tokens that may have been exposed.

Long-term Measures:

• Implement log redaction for all sensitive data (tokens, passwords, PII).
• Use environment-specific configurations to prevent debug flags in production.
• Regularly audit logs for accidental exposure of sensitive information.
• Monitor for the use of debug flags in production.

Workarounds:

• None available. The only fix is to upgrade or disable debug logging.

Valters IT