Improper Validation of Specified Quantity in Input Affecting oauthlib package, versions [3.3.0,4.0.0)

Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via DeviceCodeGrant.validate_token_request, which performs no validation of the device_code parameter. An attacker who knows a valid client ID configured for the device workflow can call the token endpoint with grant_type of "urn:ietf:params:oauth:grant-type:device_code" and an arbitrary device_code value to obtain a bearer token without possessing a legitimate device code. This violates the requirement in RFC 8628 Section 3.4 that device_code be a required and validated parameter, analogous to the checks performed by AuthorizationCodeGrant.validate_token_request.

Create an implementation of RequestValidation.authenticate_client that returns True if the client's client_type is "public". You would find yourself in this scenario because there's another issue with DeviceCodeGrant.validate_token_request where it doesn't properly handle public clients (see https://github.com/oauthlib/oauthlib/issues/919).

Create a client that has a client_type of "public" and set it's grant_type to "urn:ietf:params:oauth:grant-type:device_code".

With this implementation of RequestValidation.authenticate_client done, use that validator for your token endpoint. Call the token endpoint with a body of

{
  "client_id": <ID of the public client you made>,
  "grant_type": "urn:ietf:params:oauth:grant-type:device_code",
  "device_code": <anything you want since it's not validated>
}

You now have a bearer token for the client without a valid device_code.

Note: The PoC requires a custom RequestValidator.authenticate_client implementation that returns True for public clients, and a client configured with client_type of "public" and grant_type of "urn:ietf:params:oauth:grant-type:device_code".

• GitHub Advisory
• GitHub Release