CVE-2013-4346

Remote attackers perform replay attacks due to missing nonce verification in SimpleGeo python-oauth2 Server.verify_request function

• CVSS 4.3
• CWE-310
• Authentication, Authorization, and Session Management
• Remote

The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL.

CVE

CVE-2013-4346

CWE

CWE-310

CVSS base score

4.3

Published

2014-05-20

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Authentication, Authorization, and Session Management

Subcategory

Insecure Authentication Mechanisms

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update SimpleGeo python-oauth2 to fix the nonce-checking vulnerability.

class Server:
    def verify_request(self, request):
        nonce = request.get('nonce')
        
        if nonce:
            print("Nonce received:", nonce)
        
        return True

server = Server()

def handle_request(request):
    if server.verify_request(request):
        print("Request is valid.")
    else:
        print("Request is invalid.")

handle_request({'nonce': '12345'})

import time
import re

class Server:
    def __init__(self):
        self.used_nonces = set()

    def is_valid_nonce(self, nonce):
        return isinstance(nonce, str) and re.fullmatch(r"[a-zA-Z0-9]{8,}", nonce)

    def verify_request(self, request):
        nonce = request.get('nonce')

        if not nonce or not self.is_valid_nonce(nonce):
            return False

        if nonce in self.used_nonces:
            return False

        self.used_nonces.add(nonce)
        return True

server = Server()

def handle_request(request):
    if server.verify_request(request):
        print("Request is valid.")
    else:
        print("Request is invalid.")

handle_request({'nonce': 'abc12345'})

@misc{vaitp:cve20134346,
  title        = {{Remote attackers perform replay attacks due to missing nonce verification in SimpleGeo python-oauth2 Server.verify_request function}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2014},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2013-4346},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2013-4346/}}
}