CyberRota Analysis
AI-GeneratedThe Doorkeeper OpenID Connect implementation prior to version 1.10.4 is vulnerable due to improper validation of client-supplied scopes in the Dynamic Client Registration (DCR) endpoint, potentially allowing self-registered clients to gain unauthorized access to elevated scopes. This could lead to privilege escalation, compromising the intended access controls of Rails applications utilizing this authentication provider. Organizations using affected versions should prioritize upgrading to version 1.10.4 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration (DCR) endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certain conditions, this allows a self-registered client to obtain scopes beyond what the server intended to grant. In DynamicClientRegistrationController#application_params, the scopes attribute is assigned directly from params[:scope] with no validation against Doorkeeper.configuration.scopes or optional_scopes. Combined with enforce_configured_scopes being off by default and Doorkeeper's ScopeChecker prioritizing application-level scopes over server-level scopes, this creates a privilege escalation path. This issue is fixed in version 1.10.4.